Re: private relay ... could i use srs to avoid spffail?

In <[email protected]> "Stuart D. Gathman" <[email protected]> writes:

> On Fri, 1 Dec 2006, wayne wrote:
>
>> Doesn't doing SRS on all outgoing email cause problems with certain
>> mailing lists (ezlm?), vacation programs and other (broken) stuff that
>> assumes the 2821.MAILFROM stays constant?
>
> Yes it does.  Another problem is broken MTAs that think '+' is an
> illegal localpart char.

Huh...  I thought "plus addressing" was very common.  I wonder how
much legitimate email those systems lose.

Are there any other characters used by SRS that cause problems?  The
equals or the dash?

I seem to recall several other characters causing way too many
problems, even though they are valid according to RFC2821.



>> Some people have also suggested that by using SRS on all outgoing
>> email lets you reject bogus bounces, but in order to do that you have
>> to make sure that *ALL* legitimate email sent using your domain name
>> gets processed by SRS.  Roaming users and people working form home and
>> such have to be tought to always use RFC2476's SMTP submission port
>> (587).
>
> Making roaming users always relay through home is essential for a decent
> SPF policy also.  Note that Outlook must use smtps (465) instead.
> Another solution is an SSH tunnel (e.g. Putty for Windows) or a VPN.

Right, and using the submission port is also important for things like
DK/DKIM.  I strongly support this in all cases, but I realize that it
will take a fair amount of work on the domain owners part to make sure
that this happens.

This is actually one place that SPF can help, even if you prefer other
systems.  By putting a "tracking exists" in an SPF record and
monitoring your name server logs, you can often tell who is not
relaying email through your authorized MTAs.  Just use something like:

domain.tld TXT  "v=spf1 exists:_h.%{h}._l.%{l}._o.%{o}._i.%{i}._spf.%{d} ?all"


-wayne