I have as poor opinion of the SPF koolaid as even you, John.
But, DKIM and virtually any other message authentication method would
fail in this too.
Actually, the problem is SPF's -all option, in which senders declare
that they know all the paths that a message could possibly take. (Or,
I suppose, wacky SPF implementations that pretend they saw -all even
if it's not there.) We have a fairly clear understanding in the DKIM
group that you treat a message with no signature or a broken signature
the same as you would treat it now, and the lack of signature doesn't
say anything bad about a message. There's an optional add-on called
SSP which is the moral equivalent of -all, but it's not part of the
base spec and I don't expect anyone to use it other than a few
optimists who think that somehow it'll solve the phishing problem.
In this particular application, though, the problem is not SPF but
just ineptness. If you're using mail to send a message from one part
of your application to another, I would think that regardless of
what techniques you use, you'd set the receiving end of the mail to
whitelist the source. That's what I do.
R's,
John
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg