Re: Spamming...

On Thu, Apr 28, 2005 at 03:16:34PM +0100, Chris Haynes wrote:
> The proposition that SPF was primarily intended for spam reduction was 
> deprecated long ago.  Its focus is detecting forgery of origin.

Problems here are:

(1) does the "return path" equate to the "origin" ?
(2) even if it does, the return path is generally hidden from the the MUA
    user. They will see From: or Reply-To: or some E-mail address buried
    within the body of the message, and send their reply there.

So IMO, SPF is still attacking the wrong problem by looking at return paths.
By that measure, DomainKeys is at least trying to attack the right problem.

There's the smaller problem subset of joe-job bounces. SPF does a poor job
with those, since it requires universal adoption; SES etc. do a much better
job, in that you get immediate benefits without waiting for the rest of the
Internet to implement SPF (which I'm pretty sure they won't).

> It's generally regarded as 'a good thing' if spammers adopt SFP, because 
> then you can probably trace them via their DNS registration

I think this is clearly untrue.

Spammers have large lists of E-mail addresses, right? And they have access
to the DNS? So when sending mail from IP address X.X.X.X, which may be an
0wned machine or an upstream smarthost, they just pre-filter their list of
E-mail addresses to find any ones whose SPF policy permits sending from
X.X.X.X, and just use those as the sender addresses.

That would include:
- all domains not publishing SPF information
- many domains belonging to the ISP the spammer is sending from
- many domains belonging to other customers of the ISP the spammers is
  sending from

And, of course, spam with no return address. They don't need to register
*any* domains of their own.

I think in most cases there will be hundreds of thousands of addresses to
choose from as envelope sender when sending from X.X.X.X. The spam will have
a forged return address, but it will be SPF-compliant. The owners of those
domains have done nothing wrong, so there is no reason to reduce their score
in any sort of reputation-based system.

I believe this is bound to happen if the world goes down the SPF route, just
as surely as when receivers started validating the domains in envelope
senders, the spammers started putting valid domains in there (and thus the
joe-job was born).

If that's true, then SPF will have gained nothing, and will have cost a lot.

Brian.