On 9/17/07, Michael Kaplan <michaelkaplanasrg(_at_)gmail(_dot_)com> wrote:
I am concerned about forwarded email. Once the Receiver Generated SPF
database is established then most of the unauthenticated ham will come via
forwarders who already accepted the original email. I'm open to any
suggestions on how to work around this, otherwise I still argue that highly
selective bounces are only mildly evil.
Quarantine (or soft-fail) and query the recipient. Parse the headers in the
forwarded message; if a spf-good appears earlier, offer the addressee the
option of whitelisting the final relay. The addressee has signed up for the
protection, knowing there may be a touch of configuration. Integrate with
reputation systems (and refer to documentation strongly suggesting using
a SPF-compliant RFC 821 "SRS" envelope instead of a simplified one) in
the 450 rejection) and statistical analysis in deciding how to dispose of
such messages.
--
"I will not tolerate continued noncompliance"
-- Neelie Kroes
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg