On Wed, 26 May 2004, Theo Schlossnagle wrote:
If I sent two email to each from:
MAIL FROM:<user(_at_)victimdomain1(_dot_)com>
and
MAIL FROM:<user(_at_)victimdomain2(_dot_)com>
it would cause 50,000 CBV checks against each domain all coming from
different mail servers. That qualifies as a DDoS.
Sure. And if you did the same with 50,000 sites that check SPF, you'd
cause 50,000 DNS requests against each domain, all coming from different
mail servers. Does that mean SPF should be rejected as an evil tool that
can be used in DDoS attacks?