Re: misconception in SPF

> so you can forge emails as if they come from www.google.com even if
> there exists an SPF record for google.com !

You can also put go0gle[dot]com or googgle[dot]com in the envelope as neither have an SPF record.

Heck, you can even use google.com, the SPF record of which only tells the receiving MTA that it probably wasn't Google who sent the email, for it uses ~all rather than -all. And even if it did use -all, it doesn't necessarily mean that the email wouldn't get delivered as not all spam filters/MTAs block SPF fails.

So the 'problem' you've stated is ONE OF MANY WAYS in which a forged email can avoid being blocked by ONE OF MANY TESTS that is applied by SOME MTAs. Incidentally, it is ONE OF MANY WAYS that could confuse an end user who is looking at something most of us agree they shouldn't be looking in the first place and that BARELY ANY END USER looks at.

Unless you can finally come up with actual evidence that such emails are a) more likely to be delivered than other emails claiming to come from the target domain AND b) are more likely to be taken for real by the average end user, I think we're wasting our time here.

Martijn.

________________________________

Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.