Re: SPF and bouncing

On Sat, 5 May 2012, Alessandro Veseley wrote:
> > Because the HELO name can be anything, so arranging for an SPF HELO
> > pass is trivial.
>
> You must mean address literals, which are mostly used by MUAs AFAIK.

No, it has nothing to do with [] in addresses.

The problem is that the HELO domain is of no use in determining if an
incoming MAIL FROM: <> has anything to do with a message you actually
sent in the past month.

gmail.com's MXes and smarthosts are kept within the domain of their
corporate sponsor, google.com.  If gmail.com were ever to issue a bounce,
it would likely bear a HELO ending in .google.com.  So a naive algorithm
that said "let a purported bounce through if the HELO is SPF-approved and
is equal to or a subdomain of any domain we have mailed to in the past
month" would fail badly for at least one major site.

Drop the "is equal to or a subdomain" requirement, and any spammer who
wants to exploit the <> loophole will do so using a HELO domain that he
fully owns.  Then it's trivial for him to engineer a genuine SPF Pass.

Thus, for spam control purposes it is best to ignore the HELO (aside from
certain idiot filters), and treat all <> mail as effectively SPF-neutral.

---- Michael Deutschmann <[email protected]>