On Wed, 4 Aug 2004, wayne wrote:
If, instead, Spamassassin (and similar systems) were to give *zero*
additional score for a sender which passes SPF, then spammers would
have nothing to gain by publishing those records. SPF could still be
used in conjunction with Spamassassin, to take messages which fail
SPF, and either reject them, or give them high negative scores.
That is *exactly* what Spamassassin does. I have no idea where the
assumption that the Spamassassin folks are clueless came from. They
understood these issues when they were participating in the SPF
mailing lists last year.
Yes, hopefully they have learned to avoid mistakes like this after the
wild swing in scores (first positive then negative) to things like Habeus
and (unverified) PGP signatures.
-Rand