Re: Sending Non Delivery Reports? (was Pump and Dump)

Blammo wrote:
> On 05 May 2006, - Garen Erdoisa entered spamcop and left 
> news:[email protected]:
> 
>> AFAIK It was never intended for SPF 
>> to check the From: header given in the message data because to do so you 
>> first have to accept the data.
>> ...
> 
> I know that, but the common response to "someone's forging my domain" is 
> "get SPF", which doesn't exactly stop anyone from forging your domain. It 
> won't even stop many bounces since most of us try not to bounce anyway (I 
> mean, you expect servers that bounce to use SPF?).

SPF is a viable solution to such forgery. It's a perfectly valid answer 
to suggest adopting SPF as an answer to such a question.

I agree with you that SPF will not stop header forgery. However it does 
provide a mechanism that mail administrators can use to detect such 
header forgery and make a decision on the spot to accept or reject email 
during the SMTP transaction based on that test before accepting the data.

Servers that bounce have other more serious issues. SPF might or might 
not help with that. I think that their administrators still have to 
ultimately take responsibility for and fix the underlying issues that 
are generating the bounce messages in the first place even if they adopt 
SPF.

> 
>> That policy is up to the mail administrator. They can accept and tag 
>> emails that fail an SPF check if they so choose.
> 
> Well that's what its good for. Why not expand on that and have a "SMTP=Yes" 
> or "SMTP=No" text record for PTRs? Put authenticated senders in the 
> Received header? Some DNSBLs I tag, but if it's in two I reject, math works 
> too.

That is effectively what SPF does. It states "SMTP = yes for these IP's, 
SMTP = no for everything else."

I also use DNSBL's here. Spammers can publish SPF records too. This 
doesn't make any difference to me if they do or not. I actually hope 
they will because it makes them that much easier to block. What it does 
do is allow *me* to state *what* servers are allowed to send mail using 
*my* domain name in the envelope sender.

As far as SPF relates to me and how I use it that is all I really care 
about what it does.

The flip side to that is that I also honor (out of common courtesy) the 
SPF policies of others who publish their policy, thus rejecting mail 
that fails the test.

Both are my choices. You don't have to implement SPF if you don't want 
to. SPF compliant mail servers will not reject your mail if you don't 
publish an SPF policy. They may reject it for other reasons, but that's 
another issue.

Remember, SPF is an experimental protocol. According to what I read last 
night it looks like it is going to remain in the experimental state for 
at least 2 more years. Since you obviously feel so strongly about it, 
might I suggest that you join the forums that discuss the protocol and 
voice your feelings there as well? Perhaps those that are more 
enlightened than I can sway you, or perhaps you can sway them. :-)

--
Garen