Dave Crocker writes:
If it were strictly a local matter, it would not need to be published
in the DNS.
The problem is that the receiving SMTP server is required to interpret
the SPF policy that is published by a sender some indeterminate
number of MTA hops upstream.
That is very much NOT local.
Right. I'd like the publication to contain only an address/port. The
receiving SMTP sender looks the address up, makes an RPC to the
published address (e.g. using UDP, although BXXP is a possibility too),
receives a well-defined FAIL/PASS/NEUTRAL answer, and that's it.
The address/port may be located at the site that makes the policy, or it
may be at a third party which offers a wizard like that Pobox offers
for SPF.
Arnt