Earlier someone raised the question of what happens when spammers take
to forging sleepy little domains that have no SPF records and will never
publish them. This is a good objection to which I could only say "SPF
is anti-forgery first and anti-spam second, not an FUSSP."
But consider this.
By the time we get to that point, I expect all major ISPs to have dealt
with SPF and set up the correct records. All ISPs really, big and small.
Then the sleepy domains will be vanities and really small domains. Most
of them will send mail through a relay host. I think.
At that point people may decide on their own that best_guess will do,
and if mail for the domain isn't coming from a a/24 mx/24 ptr, then it's
probably bogus. They may accept it but be strongly biased against.
Then those sleepy domains will have even more reason to publish --- if
getting joe-jobbed wasn't good enough, maybe the fact that nobody's
reading their mail will help.
Or SMTP receivers might use the vaporware reputation system I've been
describing to decide whether the sending server is generally good or bad
based on its own ip address and spf record and so on.
-------
Sender Permitted From: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
Latest draft at http://spf.pobox.com/draft-mengwong-spf-02.9.4.txt
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname(_at_)©#«Mo\¯HÝÜîU;±¤Ö¤Íµø?¡