Re: SRS comments/questions

On Fri, Jul 15, 2005 at 10:46:10PM -0500, Damian Menscher wrote:
> A bit OT, but SPF seems doomed to failure.

Quite right. More importantly, as an anti-spam measure it is also doomed to
failure, even if the whole world adopted SPF. That's because SPF policy is
public; it's trivial for spammers to select sender addresses which pass SPF
policy for the machine they're sending from or relaying via, simply by
pre-filtering their existing lists of E-mail addresses against SPF.

> I'm curious what the advantages to SRS are, 
> considering that SPF can't possibly work.

You can use SRS by itself, to sign all your outgoing mail - then you can
reject bounces to messages which were not sent by you in the first place.
This protects you against 'joe jobs'. If you do this, then anyone who does
SMTP callback verification of senders will be able to show whether your
address is being spoofed or not - solving the same problem as SPF was
supposed to solve, but much more simply, and without the nasty side-effects.

There are other similar proposals in the pipeline, e.g. BATV, SES.

Brian.