Am I the only one who has a problem with this whole certificate scheme?
(and
I mean 'scheme' in the broadest sense of the term).
No. I don't understand all this talk of accreditation or reputation as it
relates to SPF. I publish SPF records and all that those records tell anyone
is what servers from which my domains are sending mail. Whether someone
chooses to accept mail from *my* server (verified by SPF), and what methods
they are using to determine whether or not the mail from *my* server is
acceptable has nothing to do with my SPF record.
I see SPF playing a role in spam protection by rejecting mail which fails
the SPF check and adding confidence to accepting mail whoms domain matches a
whitelist. Any spam sent by someone who owns the domain is obviously going
to pass the SPF check and needs to be filtered via other means. Likewise,
passing the SPF check only means the from address is *problably* not spoofed
and adds no credability to the content of the mail.
_____________
Take care,
Tom