Re: SRS/SPF Help Needed

On Mon, 10 Jul 2006, Andy Shellam wrote:

<< >>

> A client has his own domain name: "external.com."  He points his MX records 
> to my servers, and sends all outgoing e-mails through my servers (announced 
> as exchange.mailnetwork.co.uk and dns.mailnetwork.co.uk.)  If the client does 
> not know about SPF, and/or doesn't have access to his DNS to add TXT records

If the client was able to point his MX records to your servers, then he 
has to some degree control over his DNS, even if it's to ask the sys admin 
to make the modifications.

> - he sends an e-mail to, for example, publicdomain.com.  The MX at 
> publicdomain.com looks up SPF for "external.com", however because there are 
> no SPF records, the message gets rejected (or treated as a possible forgery.) 
> Therefore SRS would be needed to rewrite the address to have come from 
> mailnetwork.co.uk.

I don't think that's right. That would, in fact, be the very forgery that 
SPF is designed to block and isn't the proper application of SRS. What 
needs to be done for external.com, since we've established that the client 
has some degree of control over his DNS (it's a necessity), is to use the 
"include" parameter in the TXT record, something like this:

 	TXT "v=spf1 a mx include:mailnetwork.co.uk -all"

Then mailnetwork.co.uk is an "authorized" mail relay or MTA for 
external.com.

-- 
Robert Muchnick
Xenterra.net
720-276-7917