Re: VGER does gradual SPF activation (FAQ matter)

Kyle Moffett
2006-06-16T03:54:09Z

Thinking more on this and looking for possible solutions: One
(voluntary) technical solution to a mildly technical problem of lack
of authenticity would be to write a mail server (or just glue postfix
and apache with some perl CGIs) which stored the emails locally and
added a header like this:
> X-Hosted-Email: http://my.mail.server/hosted-email?id=$BASE64_HASH

Then replace the body with this:
> You have received a hosted email from "John Doe"
> <jdoe@mail.server>. Click the link below to view the email, or
> install a free hosted-email client from http://
> oss.hosted.email.project/
>
> http://my.mail.server/hosted-email?id=$BASE64_HASH

The templated message might start to get filtered by a few spam-
filters, but it makes blacklisting of abusers much easier so such
messages could easily be given a big +bonus in spamassassin or
similar. If each compliant server along the way checked that the
host server was up and provided a compliant SMTP-over-HTTP email it
would be a trivial load for individual hosts but a quite considerable
load for spammers. In addition it's possible to implement other
checks like wait-for-http-response-before-accepting-email, content
filters, digital signatures, and other processing steps. Such a
system would be very reliable and easy to implement by relying on
existing proven technologies (SMTP and HTTP) in completely standards-
compliant ways. Just some food for thought.

Cheers,
Kyle Moffett