Re: Why SRS really sucks

On Mon, 27 Mar 2006, Johann Steigenberger wrote:

> There are more easy way to deal with faked bounces.
> If you have for e.G a good policy, those will not impact on you ...

Only if every MTA in the world correctly implements SPF.  MFROM
signing (via BATV or SRS or SES) is for mail bounced from MTAs
that *don't* check SPF. 

> Think about this:
> What will never be in an authentic bounce?
> Links to remote hosted pictures, HTML, Non English charsets ....
> Those could be found in an attached message but not in the bounce itself 
> Should i continue ?

Apparently, you've never encountered bounce spam.

> Anything which claims to be an NDR and contains such crap will
> logically not be a bounce, simply reject or discard it :-) 

But this is heuristic decision.  By signing MFROM, you have a 
solid mechanical means of discarding fake NDRs.

> My point of view is that it should NOT be used for anything.
> 
> It breakes SPF. And this is the Problem.

SRS is also fine when legitimately forwarding mail.  It is simply a
way for a 3rd party forwarder and the recipient to work together
with no special configuration required for the recipient.  Of course,
if the forwarder doesn't check SPF, there is no point in the recipient
doing so either...

-- 
	      Stuart D. Gathman <[email protected]>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flammis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.