Re: Local policy - disallowing +all

On Thursday 13 September 2007 10:15, Jeremy Jackson wrote:
> On Thu, 2007-09-13 at 09:58 -0400, Scott Kitterman wrote:
> > On Thursday 13 September 2007 09:48, Jeremy Jackson wrote:
> > > Since implementing milter-greylist here a few weeks ago, the few spams
> > > that have reached my Inbox here have been from domains (presumably
> > > owned by or targeted by spammers) with SPF records ending in "+all"
> > >
> > > I see there is some ability to add local policy, but it seems like it
> > > would need to be extended to be a general purpose filter that could be
> > > used to remove the "+all" when being used by milter-greylist for
> > > auto-whitelisting, for example.
> >
> > A better approach, I think, would be to keep a list of domains that get
> > SPF Pass that spam you and just reject mail from those domains.  As we've
>
> Well this is becoming a job like writing virus definitions... never
> finished.  It smells like a bad design if that's the case.
>
> > discussed previously, it's trivial to have a record equiavlent to +all
> > that doesn't look like it.
>
> I'll check the list archives, but if this is true, it seems like
> spammers will defeat it easily, once it becomes popular enough to matter
> to them.
>
> > Rather than special case +all, I think you'd get more mileage out of a
> > more general solution.
>
> Adding domains manually to a blacklist sounds like special case to me, I
> was hoping SPF would be a general solution...

If you are doing it manually, sure.  

This can be automated quite easily.  If you look at the pymilter project on 
Sourceforge with pygossip all the bits are there.

I agree that manual lists aren't scalable.

Meng Wong (the Father of SPF - not the inventor as he built a lot on previous 
work) once said that SPF is to anti-spam as flour is to food.

I would say that SPF is one component of a general solution.

Scott K

-------------------------------------------
-----------------------------------------------------------------------
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?member_id=6959932&id_secret=41520217-32677e
Powered by Listbox: http://www.listbox.com