Stuart D. Gathman (stuart(_at_)bmsi(_dot_)com) wrote:
Level 0:
Check a subset of mechanisms: A, PTR, MX, ALL. Be sure that "unknown"
results from an unrecognized mechanism. Do not support macros.
Don't bother with Received-SPF.
If you don't include an Received-SPF header, then what would you do
with an "unknown" (or "neutral" or even "pass") result?
Level 1:
Check recursive mechanisms and macros: INCLUDE, EXISTS. Add Received-SPF
headers, for inspection by downstream software (e.g. bayesian filters will
learn to use SPF results other than 'fail', including 'neutral' and
'softfail', in recognizing spam). Reject mail giving a 'fail' result with
code
551 and the recipient (allows the mail sender to bypass a non-SRS forwarder).
I'd say that this is where the natural split occurs: whether simply
to mark the messages with Received-SPF headers, or to reject messages
outright at the SMTP layer. I'm doing the former right now.
--
Greg Wooledge | "Truth belongs to everybody."
greg(_at_)wooledge(_dot_)org | - The Red Hot Chili Peppers
http://wooledge.org/~greg/ |