Re: private relay ... could i use srs to avoid spf fail?

David Woodhouse wrote:

>On Thu, 2006-11-30 at 13:22 +0000, Camart Office wrote:
>  
>
>>hi folks,
>>
>>i would like to provide a private SMTP relay so anyone (with any email 
>>address) on a particular network could use this SMTP server for outgoing 
>>mail.  We can assume that this server will never be listed in any 
>>domain's SPF records.
>>
>>i think (please correct me if i'm wrong!) this would cause spf failure 
>>.... if [email protected] is using SPF on domain.com, this would cause 
>>spf failure if delivered via my relay
>>    
>>
>
>Yes, but that would be the fault of the recipient -- they should stop
>using SPF if it's rejecting valid mail.
>
>I _have_ set up my relay so it's able to use SRS for relayed mail -- but
>  
>
Aha!  That was my next question - whether it is easy/possible to use SRS 
for *relay* rather than *forwarding* ... all the documentation I have 
been able to find has, understandably, only discussed forwarding.

Which MTA did you use? Did you need to do anything exotic to make it use 
SRS for relay?

>it only needs to do so in the case where:
> 1. The sender address has an SPF record.
>  
>
That seems very sensible - absolutely no point monkeying around if SPF 
isn't used!

> 2. The recipient is known to check SPF and reject for failure.
>
>I have a 'blacklist' of the second type of recipient, but in fact it's
>empty apart from the test cases, because whenever forwarded mail has
>been rejected and I've contacted the admin of the offending server
>they've fixed it by no longer using SPF. So I basically never do SRS on
>forwarded mail because it never matches condition #2.
>  
>
In this case it really needs to work first time with unknown destination 
servers.  I'm looking to provide a relay for random guests who are just 
'dropping in' to our network.  Some of them are non technical people 
whose mail client is configured to use their ISP's SMTP server.  They 
don't understand why they can't send mail from our network, so we are 
considering rerouting all outgoing SMTP through our own relay..... 
simple enough, but we don't want to introduce SPF Fail problems for 
people who would otherwise have sent mail fine through their own SMTP 
server.

Thanks again for your reply

Aparimana

>  
>
>>i wondered if i could use srs to get round this in some way .... treat 
>>each email as if it were being forwarded from the server's default email 
>>address insted.  does this sound feasable? if so, am i right in thinking 
>>that the final recipient would see the 'tagged' srs address as the 
>>'from' in their email client?
>>    
>>
>
>It wouldn't appear in the From: address; only in the Return-Path:. But
>the return-path is the most reliable way of filtering traffic from
>mailing lists into the appropriate folder, so some people _do_ use it
>and care about it. I would be reluctant to mangle it without good
>reason.
>
>I recommend that you don't use SRS on forwarded mail. If you find you
>have problems with people rejecting mail for SPF failure, contact them
>and explain that they should not be using SPF. It usually seems to work
>on the people who've been taken in by the SPF 'marketing' and who didn't
>realise that SPF was incompatible with mail in the real world today.
>
>  
>