Re: A new SMTP "3821" [Re: FTC stuff...........]

----- Original Message -----
From: "David Woodhouse" <[email protected]>
To: "Dean Anderson" <[email protected]>
Cc: "Chris Haynes" <[email protected]>; "MXCOMP" <[email protected]>
Sent: Monday, December 06, 2004 6:34 PM
Subject: Re: A new SMTP "3821" [Re: FTC stuff...........]


> Not really. Hardly anybody actually rejects for an SPF failure anyway.
> You can't -- you'd throw away too much valid mail.

Not according to our 1 year plus of real production in thousands of sites.

One thing is for sure to come to learn:

Spammers don't complain.   If there are FALSE positives for legit systems,
you will quickly get reports or compliants.   The one segment that are not
complaining is the problem senders/spammers/spoofers.    The reality is the
former is extremely rare and when it is reported, it is all usually due to
getting a network correctly configured which should of been the case in the
first place.

Our view is this:

If you are using a SPF domain, then you either have your network correctly
setup for outbound mail or you dont.   The alternative is to use the relaxed
provisions (softfail and neutral) in which case, it allows for a Receiver to
perform further testing as I illustrated in my previous post regarding the
mix policy.

The main problem I see is that the "advertisement" the SPF people to tell
all people to go ahead and publish a SPF DOMAIN in DNS even if  your own
servers are not SPF ready.

That is half the problem as I see it today as evident with my own private
email account with FastAccess Bellsouth.  They added an SPF domain which
brings the usage of legitimate users usage of Alias Addresses when the mail
hits a SPF server downlink

This is where the SUBMITTER proposal had some promise to assist.  But it
assumes the BellSouth Server was SPF/SUBMITTER ready (as well as downlinks)
and its not. :-)

Sincerely,

Hector Santos, CTO
Santronics Software, Inc.
http://www.santronics.com
305-431-2846 Cell
305-248-3204 Office