In <20040203195656(_dot_)GO7601(_at_)dumbo(_dot_)pobox(_dot_)com> Meng Weng
Wong <mengwong(_at_)dumbo(_dot_)pobox(_dot_)com> writes:
There is a huge demand for header verification.
Yep, no surprise there.
So I'm going to put the "Resent/Sender/From" rules into the SPF draft
and basically say to people "SPF was designed to work on the envelope.
But if you want to use it on the header, here are some suggested rules
for choosing the right header to test. Good luck! No guarantees! Have
fun storming the castle!"
As long as SPF isn't *REQUIRED* to do header checking and as long as
it remains "designed to work on the envelope", then I'm quite happy
with the situation. Similarly, SPF shouldn't be *REQUIRED* to work in
the MTA.
As I've mentioned before on this subject, one of the gotchas for doing
doing the checking on the From: header include things like email
forwarded through mailing lists and through forwarding services. From
an individual email users' perspective, these sources of email with
mismatched envelope/header froms is pretty consistent. They don't
subscribe to new mailing lists or forwarding services very often. As
a result, these sources can often be automatically detected, which
would make user intervention even rarer.
I think that SpamAssassin already does a lot of this stuff. It has
code to try and determine where the boarder MTAs are in the Received:
header chains, so they know where to get the right IP address from.
SpamAssassin also has an automatic whitelist which could be used.
Most importantly, SpamAssassin will use these SPF checks on the
headers as just one part of an overall spam score, so the inherent
fuzziness of header checks shouldn't cause too many false positives or
negatives.
-wayne
-------
Sender Permitted From: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
Latest draft at http://spf.pobox.com/draft-mengwong-spf-02.9.5.txt
Wiki: http://spfwiki.infinitepenguins.net/pmwiki.php/SenderPermittedFrom/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname(_at_)©#«Mo\¯HÝÜîU;±¤Ö¤Íµø?¡