Re: SRS/SPF Help Needed

"If the client was able to point his MX records to your servers, then he 
has to some degree control over his DNS, even if it's to ask the sys 
admin to make the modifications. "

True, but not all DNS providers allow clients to manage TXT records - 
before I hosted my own DNS my old provider only allowed me to add A, 
CNAME and MX records.

"I don't think that's right. That would, in fact, be the very forgery 
that SPF is designed to block and isn't the proper application of SRS."

Surely though, that's the idea behind SRS, is that it rewrites messages 
that are sent through a forwarding service to have come from the 
forwarding service - in my situation, mailnetwork.co.uk is technically a 
forwarding service for andycc.net (and in the previous example, 
external.com).  Therefore SRS on exchange.mailnetwork.co.uk would need 
to rewrite messages from andycc.net to appear to have come from 
mailnetwork.co.uk - so if a bounce is returned, it gets returned through 
mailnetwork.co.uk, and subsequently translated back to andycc.net?

If a spammer sends an e-mail claiming to be from andycc.net, then 
SPF-enabled MXs will fail it because I have mailnetwork.co.uk servers 
authorised in the SPF.  However, if the client "external.com" couldn't 
add an SPF, then the SPF would fail - which would be right cos it's 
forged.  Whereas if a genuine mail had come through my servers, the 
domain would have been written to have come from mailnetwork.co.uk and 
therefore the SPF would succeed cos it'd be a mailnetwork.co.uk server 
sending it.

Damn this takes some head-scratching!!

Andy

Robert Muchnick wrote:
> On Mon, 10 Jul 2006, Andy Shellam wrote:
>
> << >>
>
>> A client has his own domain name: "external.com."  He points his MX 
>> records to my servers, and sends all outgoing e-mails through my 
>> servers (announced as exchange.mailnetwork.co.uk and 
>> dns.mailnetwork.co.uk.)  If the client does not know about SPF, 
>> and/or doesn't have access to his DNS to add TXT records
>
> If the client was able to point his MX records to your servers, then 
> he has to some degree control over his DNS, even if it's to ask the 
> sys admin to make the modifications.
>
>> - he sends an e-mail to, for example, publicdomain.com.  The MX at 
>> publicdomain.com looks up SPF for "external.com", however because 
>> there are no SPF records, the message gets rejected (or treated as a 
>> possible forgery.) Therefore SRS would be needed to rewrite the 
>> address to have come from mailnetwork.co.uk.
>
> I don't think that's right. That would, in fact, be the very forgery 
> that SPF is designed to block and isn't the proper application of SRS. 
> What needs to be done for external.com, since we've established that 
> the client has some degree of control over his DNS (it's a necessity), 
> is to use the "include" parameter in the TXT record, something like this:
>
>     TXT "v=spf1 a mx include:mailnetwork.co.uk -all"
>
> Then mailnetwork.co.uk is an "authorized" mail relay or MTA for 
> external.com.
>