On Fri, Jun 11, 2004 at 11:22:48AM -0700, Jonathan Gardner wrote:
| (2) We publish a few articles in the US and Europe. Japan, Korea, and China
| are largely left out of the loop. We only get the attention of a fraction
| of email participants. When the flag day passes, massive amounts of email
| get dropped. The poor email administrators don't even know that their email
| is getting dropped for days or even weeks. When they do a thorough
| investigaton, they finally get a response: We are dropping your email
| because you aren't publishing SPF records. Well what good does that do them
| now? They've lost several days of emails and they've never been notified of
| it in the first place!
You're right that one day, we may get to the point where we
reject mail from domains that don't publish, but it's more
likely that we'll apply the "a/24 mx/24 ptr" default first
to give them some small benefit of the doubt.
But I think it'll be possible for the word to reach those
domains virally, without the need for a mass mailing.
You see, when we designed SPF, we were counting on the
snowball effect. Here's how the plan works:
1) lots of legitimate big domains publish records.
2) those happen to be the domains that spammers forge a lot.
3) spammers find they are unable to forge those domains.
4) spammers start forging the smaller domains who are not SPF-aware.
5) the smaller domains start getting joe-jobbed by bounce
messages from spam that didn't get through.
6) postmasters at the smaller domains wonder what they can
do about this sudden increase in mail volume.
7) postmasters do some research and discover SPF.
8) they publish SPF records.
At some point, the above strategy will reach a point of
diminishing returns; maybe some sites are so poorly
administered that their postmasters don't care about the joe
jobs and never get pushed to discover SPF.
When that day comes, receivers will be justified in defining
the "a/24 mx/24 ptr -all" default --- they're doing it to
protect the little domains, after all, and it's reasonable
to think that any small domain that doesn't care about
getting tons of bounces and can't be bothered to set up SPF
records is likely to not be bothered by the best-guess
default either. And if they are bothered by it, they can
always set up an SPF record and solve all the problems.