Re: @debian.org email forwarding and SPF

[Isaac To <kkto@csis.hku.hk>]

>>>>> "Andreas" == Andreas Barth <aba@not.so.argh.org> writes:

    Andreas> * Giacomo A. Catenazzi (cate@debian.org) [040517 12:10]:
    >> Marco d'Itri wrote: >On May 15, John Belmonte <john@neggie.net>
    >> wrote:

    >> >>The debian.org forwarding done by the LDAP distributed email system
    >> >>doesn't seem to implement the sender rewriting scheme
    >> >>(http://spf.pobox.com/srs).

    >> >And let's hope it will continue this way, SPF is a solution looking
    >> for >a problem.
 
    >> The spam is a real problem, and it is demostrable that there cannot
    >> exist a perfect solution (and I suppose also a good single solution).
    >> SPF solve a small part of the "spam" problem: it will reduce e.g.
    >> the viruses "from" support@microsoft.com and the bounces of viruses
    >> and spam "send from" my address ad d.o.
    >> 
    >> If spams forge address, there should be a real anti-anti-spam
    >> motivation, so SPF will help in this relative small field.

    Andreas> And SPF breaks at the same time the ease of forwarding email.

My understanding is that SPF ignores the "From:" RFC-2822 header, and
considers only the "mail from" header during the SMTP (RFC-2821)
communication.  That means the identity of the one forwarding the mail is
used, not the actual originator of the mail.  A user who forwards a mail
(say, using the bounce feature) using the gateway he normally uses should
have no problem at all with SPF.  Only those who wants to send mail without
ever contacting its own "home" mail server (or those without authenticated
outgoing mail service) would suffer.

Regards,
Isaac.