Re: SPF (was: Re: Bug#257644: ITP: libspf2 -- Sender Policy Framework library, written in C)

[Isaac To <iketo2@netscape.net>]

>>>>> "Erik" == Erik Aronesty <erik@zoneedit.com> writes:

    Erik> I was thinking that a spammer could creates an envelope
    Erik> address with
    Erik> "SRS0+hash=timestamp=aol.com=bob@throwawaydomain.com" and a
    Erik> From: bob@aol.com with valid SPF info in
    Erik> throwawaydomain.com.

    Erik> They, obviously, could do this.  Someone who sees that spam
    Erik> will, likely, blame aol.com and not "throwawaydomain.com".
    Erik> Just like spammers use throwawar IP's to send mail, they
    Erik> will use throwaway domains to masquerate as forwarding
    Erik> agents - just like they use throwaway IP's now.

BTW, forwarding is normally set up manually, e.g., you might want your
university to forward all mails to you home ISP account.  So you know
exactly who are your valid forwarders (here, your university only).
Your case would then be trivially blocked in the client side.

Regards,
Isaac.