spf-discuss
[Top] [All Lists]

Re: softfail considered harmful

2004-02-18 02:04:40
On Wed, Feb 18, 2004 at 08:18:22AM +0000, Dan Boresjo wrote:

Domain owners need to be able to transition from "neutral" through
"softfail" to "fail" at their discretion, and we should respect their
wishes.

This is one of the reasons why the existence of 'softfail' worries me - it 
makes too many assumptions about how mail will be processed. Indeed it 
appears to dictate policy instead of being policy-neutral.

It is not good to assume that users have a 'spam' folder - I for example do 
not - nor can we assume that any 'scoring engine' is being run. 

"at their discretion".  The domain owner has a choice.  In stead of
going from "unknown" directly to "fail", there is an inbetween choice.

You do not _have_ to write such flagged messages to a spam folder. The
outcome of "softfail" means the domain owner is _almost_ sure mail should
not originate from that outlet.  You should/may/could/want to process it
as such: Most likely spam or virus, but not sure.  In stead of using "fail"
directly, the domain owner wants the receiving end to be aware of future
problems (see below).

Both a scoring system (if it is being used to any purpose) and/or a spam 
folder are conceptually similar to a 'fuzzy delete', which makes SMTP 
unreliable in terms of delivery to the end user. 

Conceptually, my spam folder is on a similar level as my SPF folder is.
Nothing more than a place where messages end up.  I have more than one
spam folder.  I treat the messages in "spam15" different from those in
"spam5" and those are itself treated different than the messages in my
"SPF" folder.  It is _me_ making the choice, and I have been using
fuzzy logic since my birth.

If delivery reliability cannot be acheived, email will stop being useful 
except as a toy.

"softfail": be prepared for this email to not arrive in [whatever] days.
Maybe the message should be attached to another one (similar to what SA
can do) with a warning notice to the receiver:

 "This message was received from an unauthorized computer.
  SPF: <domain.tld> does not designate <a.b.c.d> as an authorized
       mail injector. 

  Currently mail delivery is not YET stopped.  Please inform
  the author of the message there's a high probability messages
  will not be forwarded in the near future when sent from this host.

  The original, unmodified message has been attached to this message.
 "

See?  Deleting is NOT the only possibility.

Alex
-- 
begin  sig
http://www.googlism.com/index.htm?ism=alex+van+den+bogaerdt&type=1
This message was produced without any <iframe tags


<Prev in Thread] Current Thread [Next in Thread>