Re: SPFv3 proposal: rawfail result

On Sat, 5 Feb 2011, Stuart D. Gathman wrote:
> The whitelisting is robust for most alias forwarders when you whitelist the
> forwarder domain, and use SPF or best guess to identify mail from the
> forwarder.  When attempting the explain this before, I called it
> a "pretend" MAIL FROM.  The algorithm in its simple form goes like this:

That doesn't help with the scenario that worries me:

A user subscribes to ISP A for some time, but then switches to ISP B.
ISP A graciously sets up a forward from his old mailbox to his new one at
ISP B (this is also the situation where the forwarder is least motivated
to try something like SRS).

ISP B and the user are quite hip mail-security wise, so they arrange a
whitelisting for the servers ISP A has been using for the handoff, and
then enable reject-on-SPF-fail for other cases.

Then ISP C buys out ISP A, and consolidates mail handling at one data
center.  The forwards now come from a different IP, different rDNS domain,
and different HELO.  The whitelisting breaks.

(And then users at ISP D notice they can't mail to the forwarded mailbox,
and lobby ISP D to use "?all" instead of "-all" to work around the
problem...)

The only cure for this problem is for ISP A and ISP B to agree on how the
whitelisting is to be done.  Then ISP A will ensure that whatever indicia
are being used remain stable, or at the very least warn ISP B before
changing the handoff server.

Aside from the above scenario, merely temporarily disabling SPF to let a
few forwards through, observing the IP address, hostname and HELO, and
then whitelisting whatever seems most stable should work well enough.

---- Michael Deutschmann <[email protected]>