RE: CBV

On Fri, 7 May 2004 [email protected] wrote:

> The key problems with SES seem to be EITHER:
> 
> a) If a spammer gets hold of an SES source address, he has a free ticket 
> to spam people using replay

In conjuction with SPF, an SES or SRS source address only allows the spammer
to spam 1 particular recipient for a limited time via a forged bounce.  An SES
source is not a general relay ticket.  It is true that without SPF,
general spam victims that only check CBV will for a limited
time be tricked into thinking the sender is genuine.  But this is no worse than
the current situation of completely unauthenticated senders.  The obvious
solution is to publish SPF records *and* do SES (and SRS where needed).

-- 
	      Stuart D. Gathman <[email protected]>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flamis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.