Re: SPF

[Adam Majer <adamm@galacticasoftware.com>]

Erik Aronesty wrote:

>Isaac To <iketo2@netscape.net> wrote in message news:<2kYrZ-u1-3@gated-at.bofh.it>...
>  
>
>>>>>>>"Erik" == Erik Aronesty <erik@zoneedit.com> writes:
>>>>>>>              
>>>>>>>
>>    Erik> Spammers can use this loophole to get around SPF.  Thus SPF
>>    Erik> is ...  well ... broken.
>>
>>This complain to SRS is something new to me, and such knowledge will
>>enhance our understanding on naysayers of SPF.  Care to take a look at
>>
>>http://www.libsrs2.org/srs/srs.pdf
>>    
>>
>
>That pdf didn't work for me.  I read this instead. 
>http://spf.pobox.com/srspng.html
>
>I was thinking that a spammer could creates an envelope address with
>"SRS0+hash=timestamp=aol.com=bob@throwawaydomain.com" and a From:
>bob@aol.com with valid SPF info in throwawaydomain.com.
>
>  
>

Indeed. SRS breaks SPF. SPF seems to be good only for direct mailing
domains. It essentially breaks all lists.

I guess the only way to allow forwarding is for the MTA to sign each
outgoing message and then to publish the public key in the DNS. I don't
see another way around it.

- Adam

-- 
Building your applications one byte at a time
http://www.galacticasoftware.com