Re: SPF and bouncing

On Friday, May 04, 2012 05:12:14 AM Michael Deutschmann wrote:
> To avoid spammers using "MAIL FROM: <>" as a "skeleton key" that opens
> all the mailboxes, a whitelisting site would have to use VERP such as
> BATV.  But automatic whitelisting fails when other people VERP in the
> same way.  We have a sustainability problem.

The way that SPF attempts to deal with null mail from now is with HELO based 
checks.  These are arguably far less useful.  

Many people have reported a sharp decline in spam related backscatter after 
they publish an SPF record (I actually got one of these last week and it 
really confused me because it'd been years since I got one).  There is lots of 
empirical evidence that SPF can act as a deterrent to having your domain being 
picked at random to be forged by spammers (not 100% deterrent, but a 
deterrent).

Spammers to have not adapted to SPF by moving to null mail from's.  They've 
adapted by picking other domains to forge or setting up their own domains with 
spam friendly registrars and/or often using stolen/forged credentials and 
payment methods.

I agree that SPF does not (and cannot) deal with the null mail from very well, 
but it's not clear to me it's a pressing issue. 

> I'd fix that by coming up with a "standard SPF VERP", and then adding a
> modifier to SPFv1 to indicate that it is in use.  Then without the
> modifier, the existing precedent that SMTP local parts are opaque would
> apply.  With the option, the recieving MTA would be encouraged to apply
> a published algorithm to derive a whitelist key from the MAIL FROM it
> sees.

Google SPF SES sender -aws -amazon this isn't a new idea.

Scott K