Re: spf record
This one time, at band camp, Joe Emenaker said:
> Juha-Matti Tapio wrote:
> >
> >In a couple minutes I can think of at least the following ways to go around
> >that:
> >
> >a) Use any domain that either does not have SPF records or allows any
> >sources.
> Well, the "grand plan" for SPF is that these are going to disappear or
> become as rare as open relays. As SPF becomes more widespread, the spam
> filters will be more comfortable with being harsh to SPF-failing
> messages. As that happens, if you run a mail server... and you want your
> mail to actually get *delivered*, you'll implement SPF.
This is simply not true in the wider world of email. There are many
legitimate mail servers out there that haven't upgraded to using EHLO.
There are many people running software like qmail or exchange that
can't do recipient verification at smtp time, and produce huge volumes
of backscatter. If mail admins can't be bothered to do these most basic
of things, what makes you htink the entire world is going to switch to
using one of many competing ideas about sender verification?
Not to mention that of course spf has major implementation problems
(forwarded email being the main one, but there are others). It also is
a plan that necessitates every mail admin working in concert to make it
useful, which makes it a pipe dream. And finally, even if every one
did it, it still won't stop spam (see below). You can see most of these
arguments said better at http://david.woodhou.se/why-not-spf.html
> >For example I would be really surprised to ever see actually
> >effective SPF-records on debian.org.
> >
> Why?
> >b) Use the domain of the ISP of the zombie-machines.
> >
> Yeah.... well, zombie machines are, IMO, outside of the scope of SPF.
Well, since these appear to be the largest and fastest growing source of
spam, that about kills spf off as a solution.
--
-----------------------------------------------------------------
| ,''`. Stephen Gran |
| : :' : sgran@debian.org |
| `. `' Debian user, admin, and developer |
| `- http://www.debian.org |
-----------------------------------------------------------------
Reply to: