RE: "If you believe that the SPF concept is fundamentally flawed, please subscribe at http://www.imc.org/ietf-mxcomp/"

> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of Richard Clayton
> Sent: donderdag 26 mei 2005 18:44
> To: [email protected]
> Subject: Re: "If you believe that the SPF concept is
> fundamentally flawed, please subscribe at
> http://www.imc.org/ietf-mxcomp/"
>
> In article <[email protected]>, Mark
> <[email protected]> writes
>
> >To sum it up:
> >
> > 1): Spammers causing their registered domains to "pass",
> > only identify and>set themselves up to be block-listed.
>
> so it would be foolish of them to keep on using their domains

Ah, but they would not have much of a choice, now, would they? :) Because
registering their own domains, to make them SPF "pass",  was a stop-gap to
begin with, as they could no longer use the more reputable, protected
domains.

> > 2): Email sent with reputable domains, used without authorization by
> > spammers,
>
> so they can't borrow domains and send the email from their machines
>
> with you so far :)

Yep; that's the idea.

> Of course you may feel that if [email protected] is so dumb as
> to install a spam-sending trojan that it serves him right if example.com
> gets a really bad reputation.

In all fairness, yes. I mean, SPF will help you protect against the misuse
of your domain name by unauthorized relays. If you're no longer master of
your domain, so to speak, and your own, authorized machines start sending
out spam, well, then not even SPF can help you. But if you lost control
over your machine, then I'd say you probably have a bigger problem on your
hand than worrying about SPF.

> However, if I have a need to swap email with
> example.com employees how exactly has SPF improved the
> situation here ?

If your own machines start spewing spam, against your will and control,
then your first order of business should be to tell your employees not to
chit-chat with others in email until they fixed the flagrant breach of
security. :) Seriously, though, here SPF cannot help you, either: in order
to exercise control over your domain, you kinda have to be in control of
your domain.

> Seems to me SPF might have a few advantages relating to
> back-scatter but that too much email is being forwarded
> for that to work out in the near future. However,
> promoting it on the basis that spammers will not change
> their behaviour doesn't seem to be justified.

Whoever promoted SPF on the basis that spammers will not change should be
taken into the backyard and shot. :) SPF counts on spammers to change!

Try and look at SPF from a 'selfish' perspective: if you protect your own
domain name with SPF, then whatever other domains spammers use, at least
it won't be yours. And that 'selfish' point of view is really all a domain
owner is interested in: "So what if spammers will go use X instead? At
least they're not using Y any more, which is mine. And if that bothers the
domain owner of X, he is free to do the same."

- Mark 
 
        System Administrator Asarian-host.org
 
---
"If you were supposed to understand it,
we wouldn't call it code." - FedEx