Re: whitelist on Reply-To:

On Thu, 8 Feb 2007, Mark Horn wrote:

> I use SPF, too.  IMHO, it's not widely deployed enough to protect the
> envelope sender.  Which means that 99% of legit email addresses in my
> whitelists can be forged through the envelope sender just as easily
> as From: or Reply-To:.  For the other 1% SPF doesn't always help.

One of the main reasons I use SPF is to eliminate spam claiming
to be from my domain. After all, users in my domain are whitelisted.

> Back to the subject at hand: I have not seen forging of whitelist
> email addresses to be a source of *any* spam that I've received.
> So, whether the forged address is in the Reply-To: or From: or
> envelope sender has made no difference from my perspective.
> 
> Are other seeing differently?  

Yes. Not lots but some. Some of them I save in a spam folder.
I count 16 last year in my spam folder, but then there was 6 last week.
(now its got my attention)

At least SPF drops the ones that forge the envelope too.


-- 
Tim Rice				Multitalents	(707) 887-1469
[email protected]