Re: Harvest netblocks of good MTAs from SPF for whitelisting from greylisting

On 12 February 2013 14:16, Stuart D Gathman <[email protected]> wrote:
> On 02/12/2013 04:12 PM, Constantine A. Murenin expounded in part:
>
>> Hi,
>>
>> I'm configuring greylisting with pf(4) and OpenBSD spamd, and one of
>> the things I would like to do is explicitly whitelist good MTAs of
>> e.g. google.com, apple.com, ebay.com, schwab.com, freebsd.org,
>> uwaterloo.ca etc.
>>
>> It seems like with the proliferation of SPF, this might be relatively
>> easy to do: the netblocks of many valid email servers are individually
>> published by each respective domain through various SPF-compliant
>> records.  (And even when there are no explicit "ip4" or "ip6" records
>> with the IP addresses or netblocks, an explicit or implied "v=spf1 a
>> mx" could still do the trick.)
>>
>> What's left is to have a list of "good" domains, and a script that
>> will go through all such domains once a week to compile the list of
>> good netblocks.  Such netblocks could then be exempt from any kind of
>> greylisting, such as to never delay the mail from trustworthy domains
>> whatsoever.
>>
> You are overthinking it.  With SPF, you don't need to mess with netblocks at
> all (and that would not be practical at all with IP6). If SPF passes, and
> the domain is trusted, you are good.  That is the whole point of SPF.

But I am not using SPF in my MTA, and I do not plan to.

I'd guesstimate that a setup with pf(4) whitelisting of common MTAs
through the SPF harvesting approach described, together with
greylisting at the firewall level, for my domains would be much more
effective in combating spam than any kind of SPF or DKIM
implementations at my MTA level, and without the false positives.

Also, there's no reason why IPv6 would be different here than IPv4:  a
/48 IPv6 netblock with 2^80 addresses can still be represented through
a single record.

C.