Re: VGER does gradual SPF activation (FAQ matter)

["jdow" <jdow@earthlink.net>]

From: "Neil Brown" <neilb@suse.de>

> On Sunday June 11, dwmw2@infradead.org wrote:
>> On Sun, 2006-06-11 at 01:27 +0300, Matti Aarnio wrote:
>> > Now that there is even an RFC published about SPF...
>> 
>> Please, don't do this. SPF makes assumptions about email which are just
>> not true; it rejects perfectly valid mail.
>> 
>> http://david.woodhou.se/why-not-spf.html
> 
> Conversely, please do do this :-)
> 
> I agree with David that SPF breaks mail-as-we-know-it, but I cannot
> help thinking that mail-as-we-know-it is way too permissive and bits
> of it need to be broken (the old egg/omelette analogy).
> 
> And I think that kernel.org is a great place to start with pushing
> SPF, because if a few mail items go astray to-or-from it really isn't
> the end of the world.
> 
> - kernel.org should publish very strict SPF records that sites with
>  any gumption can reject forged mail claiming to be from kernel.org.
>  If systems drop mail incorrectly because of this, the end-recipient
>  can follow linux-kernel any number of other ways, and can badger
>  their local admins to "get it right".

Sir, I've been doing this for years already using primary source
information - the trackable message headers. So far forgeries are
not a problem. It becomes quite obvious when a message has forged
headers, obvious enough automated analysis works remarkably well.

> - kernel.org should reject mail that earns an SPF 'fail' and should
>  grey-list mail that earns an SPF 'softfail' (so the sending system
>  will have to retry once). Any mail that incorrectly gets rejected
>  will hopefully have a link to a web page that explains the problem
>  and lists a number of free-mail sites where anyone can sign up and
>  safely send mail to kernel.org.  So people who need to get mail
>  through still can, while they complain to their admins about
>  configuring things properly.

No sir. FAIL and SOFT_FAIL prove nothing. PASS proves remarkably
little. SPF is not a good criterion for much of anything.

> I think kernel.org is a great site to be an early adopter because:
>  - the mail it transports isn't critical
>  - it interacts with a very large number of mail sites
>  - it's customers are reasonably technology-savvy. 

It would be a good site to adopt it outgoing. But adopting it as an
incoming message filter is silly.

> sourceforge would be another good site.
> 
> 
> (No, SPF doesn't stop spam, but it can increase accountability so that
> white/black lists can begin to be more usable).

It does not even do that conclusively. Many of us wish it did. But if
a spammer can post his own spf records he can claim what he wants
about email sources. DNS cache poisoning attacks assure that this can
take place even for sites you might control.

{^_^}   Joanne Dow said that. Seriously, I recommend a pass through the
        old SpamAssassin users mailing list for past discussions. An
        SPF_HELO_SOFTFAIL is the only thing given a sizeable score.