On Fri, 19 Mar 2004, Marc Alaia wrote:
I don't see the advantage of your proposal. The SPF specification says that
if no SPF record is published, then to return unknown. Your record says
exactly the same thing. What value does your proposal add?
You misunderstood. My proposal would be for the default to be something
like "v=spf1 a mx ptr -all", with maybe some /24 subnet logic.
I only mentioned "?all" as a trivial action that harried sysadmins
who didn't wan't to deal with the whole SRS thing could take to
stop their mail getting bounced.
I am suggesting slightly stronger sanctions for domains with no
SPF at all (by supplying a reasonable default) - since it is so
trivial to add a simple ?all record for those who are too busy
to do it right.
The "guess" heuristic could be codified by specifying a default record
for checkers to use when no SPF record is published. This would correctly
handle the vast majority of domains, and for those where it doesn't do the
right thing - they only need to publish a record. Even if it is only
"v=spf1 ?all". Hopefully, this would motivate sysadmins to do the trivial
work of adding the SPF record. It is less trivial to add SRS, but they
can use ?all until they get around to it.
--
Stuart D. Gathman <stuart(_at_)bmsi(_dot_)com>
Business Management Systems Inc. Phone: 703 591-0911 Fax: 703 591-6154
"Very few of our customers are going to have a pure Unix
or pure Windows environment." - Dennis Oldroyd, Microsoft Corporation