[Mark Shewmaker]
And in both cases the writer of the message contents has no real limit
on those contents--we're just verifying that they are who they say they
are. And in both cases you could have reputation systems make
meta-claims about whether the particular identity is trustworthy.
A question:
I'm an evil person. I would like to stop Mark Shewmaker business (he is
competing with my products/services for example ;-).
I will submit numerous claims to reputation systems that Mark servers (by IP)
constantly send spam in my/his area.
All my prior submissions to reputation systems were about real spam
I will use legit Mark messages (not necessary) but replace content with "Buy
XXXX and link to free website (I will shutdown
this site using single email to abuse(_at_)web-domain(_dot_)com)".
There is no way for reputation system to check if Mark really spamming me or
nope.
SPF does not provide any way to perform message content/spam claims
verification.
They will most likely blacklist (or graylist) Mark addresses/servers.
Your move...
--
Andriy G. Tereshchenko
TAG Software
Odessa, Ukraine
http://www.24.odessa.ua