On Sat, 2004-07-10 at 19:24, Andrew G. Tereschenko wrote:
And one of our users start to send mass spam pretending to be
Bob(_at_)Aol(_dot_)Com
while he is not Bob.
SPF validation will pass - as his IP valid source of emails from
<anybody>@Aol.Com.
Why not simply not allow this user to pretend to be Bob?
To me it seems simpler to just not allow forgeries from MTA's you
control, as opposed to allowing forgeries into the mail stream and
asking the rest of the world to solve the problem for you.
--
Mark Shewmaker
mark(_at_)primefactor(_dot_)com