Re: spf record
On Sat, Jan 21, 2006 at 01:58:07PM +0000, Stephen Gran wrote:
> This is simply not true in the wider world of email. There are many
> legitimate mail servers out there that haven't upgraded to using EHLO.
> There are many people running software like qmail or exchange that
> can't do recipient verification at smtp time, and produce huge volumes
> of backscatter. If mail admins can't be bothered to do these most
> basic of things, what makes you htink the entire world is going to
> switch to using one of many competing ideas about sender verification?
the same reason they were forced to get off their lazy butts and
close their open relays - they (or their boss) want their mail to get
delivered. open relays run by lazy admins were once a huge problem,
probably the greatest single spam problem. RBLs fixed that. now open
relays are almost non-existent.
eventually, SPF will be in widespread enough use that lazy admins will
have to implemewnt SPF records if they want their mail to be accepted.
that probably wont be for several years yet, but it will eventually
happen.
> Not to mention that of course spf has major implementation problems
> (forwarded email being the main one, but there are others). It
> also is a plan that necessitates every mail admin working in
> concert to make it useful, which makes it a pipe dream. And
> finally, even if every one did it, it still won't stop spam
> (see below). You can see most of these arguments said better at
> http://david.woodhou.se/why-not-spf.html
restrictive SPF records aren't appropriate for most ISP domains. it's
really only useful for domains that handle mail for a single "entity" -
private individuals, businesses, corporations (i wish more banks woul;d
use it), etc - that have a smallish set of known mail servers.
the arguments against SPF are all based on the assumption that the
average generic ISP would or should publish very restrictive SPF records
- which would be foolish.
SPF is a very limited tool. it does one little job (preventing forgery)
reasonably well. the problem is that lots of people think it does other
jobs (spam blocking) too and get annoyed when they realise it doesnt and
was never intended to.
in other words: be pleased that your screwdriver is great at tightening
screws and dont worry about the irrelevant fact that it makes a lousy
hammer.
> Well, since these appear to be the largest and fastest growing source
> of spam, that about kills spf off as a solution.
SPF IS *NOT* AND NEVER WAS AN ANTI-SPAM TECHNOLOGY.
judge it for what it is, not for what it isnt (and was never intended to be)
craig
--
craig sanders <cas@taz.net.au> (part time cyborg)
Reply to: