On Thu, 2004-06-24 at 16:05, spf(_at_)kitterman(_dot_)com wrote:
I'm actually reasonably
comfortable with at least some of my neighbors. As long as people remember
that SPF Pass != not a forgery, then I should be OK.
Putting aside arguments over what's being authenticated, return-path or
PRA, part of the whole point of spf is to allow receivers to presume
that "SPF Pass==not a forgery".
If I get an spf-pass email from your business, I'm going to assume your
business is associated with the email, similar to the way that if when I
telephone your business, I'll assume that anyone who answers the phone
to be associated with your business (and able to speak for it.)
Now it may be that other people are able to access your outgoing MTA to
fool it into sending emails purporting to be from your business, so that
those emails will receive an SPF-PASS, but it also may be that you have
people who sneak into your office when you're not there to answer the
phones, purporting to represent you and thus causing callers to think
they're talking to a real representative of your business.
Not trusting the people who host your outgoing MTA to prevent forgeries
in your name is similar to not trusting your landlord not to
prank-answer your telephone: Neither is something that other people
will really expect. It may be an acceptable answer after-the-fact to
resolve a snafu, but it will go against folks' presumptions.
I would suggest that if you really can't put a reasonable amount of
trust into your outgoing MTA to guard against forgeries, that you use
existing SPF prefixes to account for that. Just publish an spf record
that ends in "-all", but containing mechanisms with a prefix of "?".
That seems to match what I imagine you're wanting to claim to the
world: "If the mail came from (here), then it may or may not really be
from me. Otherwise, it's definitely *not* from me."
It may be unpleasant to think of things in those terms, but it seems to
me to match your circumstance. Publishing such a record will allow
receivers to reject some messages that really aren't going to be from
you, and accept others with the notion that they may-or-may-not be from
you.
(I think this is equivalent to your suggestion for an authoritative
pass.)
--
Mark Shewmaker
mark(_at_)primefactor(_dot_)com