Re: VGER does gradual SPF activation (FAQ matter)

Gerhard Mack
2006-06-12T17:36:47Z

On Mon, 12 Jun 2006, jdow wrote:

> Date: Mon, 12 Jun 2006 01:23:30 -0700
> From: jdow <jdow@earthlink.net>
> To: Bernd Petrovitsch <bernd@firmix.at>
> Cc: davids@webmaster.com, linux-kernel@vger.kernel.org
> Subject: Re: VGER does gradual SPF activation (FAQ matter)
>
> From: "Bernd Petrovitsch" <bernd@firmix.at>
>
> > On Sat, 2006-06-10 at 22:17 -0700, jdow wrote:
> > [...]
> > > that matter. It simply says, "When I went and looked at the guy's claimed
> > > mail source the spf record said he was who he said he was." Who vouches
> >
> > No. SPF simply defines legitimate outgoing MTAs for a given domain.
> > Within a domain, it is up to the postmaster to allow/disallow address
> > forgery and for the rest of a world (to tell where legitimate email of
> > his domain comes from), the postmaster defines SPF records.
> >
> > Bernd
>
> And just recently we received a spate of spam that came from a domain
> that disappeared almost immediately. Domain names are cheap. They can
> vouch for the spam run. Then what happens to them doesn't matter. But
> the SPF record passes.
>
> {^_-} There Ain't No Such Thing As A Free Lunch.
> Too many people think SPF is a free lunch.

Look at it from a mail admin's perspective. The bounces are now going
nowhere instead of some poor user's mailbox. You have just cut the damage
in half.

Innerfire.net used to be foraged as a spam sender every other month and
gmack@innerfire.net so often that I still have procmail filters to
redirect bounces to their own folder. The thousands of messages I was
getting was infuriating but it has been a very rare event since I setup
SPF on my domain.

SPF may not filter spam much but if you set it to autofail you can reduce
the risk for innocent mail admins.

Gerhard

--
Gerhard Mack

gmack@innerfire.net

<>< As a computer I find your faith in technology amusing.