Re: Sending Non Delivery Reports? (was Pump and Dump)

Blammo wrote:
> On 05 May 2006, - Garen Erdoisa entered spamcop and left 
> news:[email protected]:
> 
>> How do you define "broken"?
>>
> 
> It's common knowledge, they say it right on their site. They may have fixed 
> it in the last year, but I doubt it as you indicated the problem still 
> exists.
> 
> Besides all that, SPF doesn't check the From header anyway, as far as I 
> know, so it's pretty easy to get around, as all the PayPal phish proves.
> 

The "classic" SPF version checks the envelope from and falls back to 
checking the HELO strings for forgeries. If a test is inconclusive SPF 
allows the mail to pass on through. AFAIK It was never intended for SPF 
to check the From: header given in the message data because to do so you 
first have to accept the data. DSN's are typically sent to the return 
path as given in the envelope from, which is not necessarily the same as 
the path in the From: header.

Also note that it's only when a test is conclusive as a fail that a 
message should be rejected during the SMTP transaction.

That policy is up to the mail administrator. They can accept and tag 
emails that fail an SPF check if they so choose.

There are several competing protocols right now which are in development 
and address the various aspects of sender forgery and there is an 
ongoing technical effort to resolve the conflicts between the competing 
protocols.

So what else is new? :-)