Re: SRS/SPF Help Needed

This is probably an oversimplified explanation but it should serve to 
point you in the right direction.

SPF breaks mail forwarding. For example, [email protected] (IP address 
1.2.3.4) sends an email to [email protected] who actually picks up 
his mail at its final destination 
[email protected]. So publicdomain.com is a 
forwarder (as in virtusertable) to the machine finaldestination.com.

Without SRS, publicdomain.com will try to forward the mail to 
finaldestination.com while announcing the FROM IP address as 1.2.3.4, 
which SPF will reject because it doesn't jive with the IP for 
publicdomain.com. That's the anti-SPAM aspect of SPF.

To cure this and allow desired forwarding, SRS (on publicdomain.com) 
rewrites the sender address (now seen as coming from publicdomain.com) so 
that SPF on finaldestination.com will accept the mail.

I'm pretty sure I got this right. The explanation is based on an actual 
scenario I had to deal with about a year and a half ago and implementing 
SRS as mentioned above was the only way to solve it.

It strikes me that if you're not actually going to use different server 
machines when your clients add their own domain names, and assuming you 
have your DNS TXT record set up correctly, you won't be having broken 
forwarding issues at all.

On Mon, 10 Jul 2006, Andy Shellam wrote:

> Date: Mon, 10 Jul 2006 11:56:58 +0100
> From: Andy Shellam <[email protected]>
> Reply-To: [email protected]
> To: [email protected]
> Subject: [srs-discuss] SRS/SPF Help Needed
> 
> Hi,
>
>
>
> I need some advice off people who know about SRS!
>
> I'm designing a complete mail solution system based largely on open-source
> products with custom tweaks, to support SPF, SRS and other validation
> schemes (such as DomainKeys) out-of-the-box.
>
>
>
> However, I'm having a little trouble under-standing the reasoning for
> requiring SRS.
>
>
>
> As an example:
>
>
>
> My company's domain is mailnetwork.co.uk, which has an SPF record,
> authorising the machines exchange.mailnetwork.co.uk (88.208.192.113,
> 88.208.192.114) and dns.mailnetwork.co.uk (84.18.200.160) to send mail from
> mailnetwork.co.uk, and to fail any other servers that attempt to do so.
>
>
>
> Now, how does SRS come in to this?
>
>
>
> All my current users use one of our registered domains (mailnetwork.co.uk
> and andycc.net are currently the two most-used) as their sender addresses -
> they are allowed incoming aliases (e.g. [email protected] is an alias
> for [email protected]) - however, if a user tries to use an alias as the
> sender address it is rewritten to the alias' destination address - e.g. if I
> tried to send using a From: address of [email protected], the mail
> server will rewrite it as [email protected].
>
>
>
> When it gets off the ground, users will have the ability to add their own
> domains to the system - I'm guessing in this case, the system will act as a
> forwarder, and I'm thinking this is where SRS comes in, but I'm a tad
> confused how SPF breaks forwarding and the like!!
>
>
>
> Any advice/explanations would be appreciated!


-- 
Robert Muchnick
Xenterra.net
720-276-7917