RE: Testing SRS

On Mon, 2004-06-14 at 16:30 -0500, Ryan Malayter wrote:
> [David Woodhouse]
> >Wrong. It's not about whether _you_ do any forwarding. It's about
> >whether any of the millions of addresses to which your users may send
> >email are doing forwarding.
> > 
> >>I am using virtusertable redirects, but isn't SRS supposed 
> >>to deal with this?
> > 
> >If SRS is implemented at every forwarding site to which you ever send
> >email from the domain for which you publish a '-all' record, then yes.
> 
> The SPF Publishing wizard (http://spf.pobox.com/wizard.html) uses -all
> in most situations, because most sysadmins using the wizard answer "yes"
> to the question "Do the above lines describe all the hosts that send
> mail from yourdomain.com?"
> 
> I used this wizard when I first published SPF records, and answered yes
> to that question. I thought only of mail ORIGINATING from my domain, as
> most people would.

Yes. The wizard is dangerously misleading. It tricks naïve admins into
setting up a situation where they ask third parties to throw away valid
email.

> If publishing '-all' is as dangerous as you say, shouldn't someone
> change the SPF Publishing Wizard to highlight the forwarding problem and
> recommend '~all' instead, at least for the time being?

Yes. But admitting the problem right there in the wizard would detract
from the evangelism effort, don't you think? :)

It seems that the authors of the wizard in question would prefer to
encourage others to publish broken ('-all') records, and bank on the
fact that few people are actually dim enough to bounce mail just because
it gets an SPF 'fail', as you yourself observed. 

> As many others have noted, I have not seen any bounced mail as a result
> of publishing '-all', but this is probably because most SPF-aware
> recipients are using SPF checks only as part of a larger spam scoring
> system, and are not rejecting based on SPF checks yet.

Indeed. To actually reject mail solely on the basis of an SPF 'fail'
result would be completely irresponsible.

If your behaviour carries any influence with anyone else, I also
consider it irresponsible even to publish SPF records. 

-- 
dwmw2