Re: SPF Record Issue

>> The SPF standard does not _require_ that an smtp-receiver that is
>> claimed to "support SPF" (or "honor SPF," whatever) do anything with
>> the HELO. The standard only requires that the domain of the envelope
>> sender be checked, but also _recommends_ that a receiver checks HELO.

> In one special case it does.  If mail from is empty (it's a bounce), the mail
> from check is performed with the pseudo mail from postmaster@hostname.

I actually was deliberately skipping when the HELO is checked as a
fallback mechanism w/null sender... only so much you can cram into one
already-overdone e-mail! But I should've been clear that HELO is
always recommended and in some cases required.

>> Regardless, you must be prepared, if you as a sender claim to "use
>> SPF" (or "publish SPF," or whatever terminology that implies that you
>> think SPF is useful) to have your HELO hostname looked up. The HELO
>> lookup amounts to checking if postmaster@<hostname> would be allowed
>> to send from the sender IP.

> There is a subtle distinction here.  The postmaster@ construct is a synthetic
> mail from used for bounces.  When doing an independent HELO check as is
> recommended in RFC 4408 and the current draft of 4408bis, there is no 
> localpart.  It's the hostname only.

Well clarified, just goes to show how even someone who's been on this
list since the beginning can be out of touch with the details.

When I gave 4408 a quick recheck before sending, I thought 4.3 -- "If
the <sender> has no localpart, substitute the string "postmaster" for
the localpart." -- applied to the independent and null-sender HELO
checks. I still don't exactly see where in 4408bis you clarify
otherwise, but I'll definitely take your word on it. 

-- S.