Re: Why SRS really sucks

On 3/28/06, Julian Mehnle <[email protected]> wrote:

> > Getting an SRS Mail you always have an envelope-from like this:
> > SRS*=*[email protected]
> >
> > If SPF would in such a scenario check the initial domain in the
> > localpart (in our example forwardet-domain.com) too,
> > and not only the domainpart (forwarder.com), and it found that the
> > forwarder did against the domainowners direction, this would clearly be
> > an indicator to blacklist the forwarder for SRS-Abuse.
>
> Define "find that the forwarder did against the domain owner's direction".
> You can't use SPF records to check that because SPF records only apply to
> the RHS (right-hand-side, after the @) domain of e-mail addresses, not to
> any domains embedded in the localpart by obscure sender rewriting schemes.
>
> I don't mean to say that SRS is obscure, but from SPF's point of view, SRS
> just doesn't matter.  All SPF cares about is the RHS domain and no other.

the standardization of SRS allows a fancy SPF checker to pull the LHS apart
and parse the headers for the previous hop, before checking. This kind of thing
makes sense in the situation where an ISP is properly SRS-forwarding everything
they get including SPF failures. As is under discussion.