spf-discuss
[Top] [All Lists]

Re: softfail considered harmful

2004-02-18 06:23:46
On Wed, Feb 18, 2004 at 11:28:59AM +0000, Dan Boresjo wrote:

"softfail": be prepared for this email to not arrive in [whatever] days.
Maybe the message should be attached to another one (similar to what SA
can do) with a warning notice to the receiver:

Er, no - the sender does not get warning that delivery has been deprecated, 
delayed, deleted or otherwise perjoratively labelled, unless you actually 
reject the mail.

Example:

You send mail to me.  Your domain has an SPF record with softfail. I filter
based on this softfail.
_I_ receive your message encapsulated in one generated by _my_ server. This
message tells _me_ what is going to happen.
Now, if you would be a spammer, I'd just ignore you and wait for the domain
to switch to "-all".  However, would you be a legitimate sender, I would
contact you and pass the message to you.

See?  Deleting is NOT the only possibility.

Anything that reduces the probability of a mail being read is a form of 
'fuzzy 
deletion'. If the sender is not made aware of the mail's deprecated status, 
mail delivery must be considered unreliable.

The sender should be informed by the domain owner.  The sender has to
comply with the domain owner's policy.  The domain owner sets a policy, in
this discussion the policy is that the sending HOST is not allowed to use
the right hand side.  The receiving end also set a policy; mail from
unauthorized hosts will be {encapsulated|tagged|scored|deleted|whatever}.

"Anything that reduces the probability of a mail being read..." can
translate into gazillions of spam-messages and virusses.  Most of
these use spoofed sender addresses.  I've been receiving mail from myself,
and don't like my (_my_!!!) address end up in someone's kill file just
because someone else used it to send virus or spam.  SPF protects me from
these joe-jobs, unless _you_ don't cooperate.  And vice versa of course.

Alex
-- 
begin  sig
http://www.googlism.com/index.htm?ism=alex+van+den+bogaerdt&type=1
This message was produced without any <iframe tags


<Prev in Thread] Current Thread [Next in Thread>