Re: whitelisting links (was Re: misconception in SPF)

On 12/11/2012 06:52 AM, John Johnson wrote:
> Michael Thomas wrote:
>
>> Anybody who thinks that using HTML or outsourcers are "worst
>> practices" is part of the problem, not part of the solution.
>    I highly disagree.  A local bank just hired an outside firm to
>    spam a "newsletter" to their customers in my area. It was quite
>    difficult to tell if it was legitimate, as the bank had published
>    SPF records, yet failed to provide the ip's of the outsourcers
>    servers. And then used the banks domain name as the source.

Simply being an outsourcer doesn't preclude having first party
dkim signatures.

>
>    This should not be acceptable behavior, especially for a financial
>    institution. It trains their customers to just accept anything
>    and everything, they should be setting the bar, not lowering it.
>

Customers aren't trained in anything to do with email headers of
any kind. What should and should not be acceptable behavior is
strictly between the sender's practices and the receiver's filtering.
If you want to complain, complain to the receiving MTA's. Legitimate
senders will adapt.

Mike