spf-discuss
[Top] [All Lists]

Re: Forwarding is spoofing Was: ElectronicFrontier Foundation (EFF) Article OnAnti-Spam Technologies Mentions SPF

2004-11-22 09:58:41
Hello!

On Mon, Nov 22, 2004 at 04:32:08PM -0000, Richard Bang wrote:

RFC822 1982 descibes the use of the resent headers and the implicit
assumption that forwarders would be sending the message from themselves to
the new address. 

Really existing setups do this when you *manually* resend mail, like
from mutt's b(ounce) function. The mail gets a new envelope sender and
Resent- headers. But on automatic MTA-based forwards (i.e. .forward
or equivalent), that wouldn't make sense, because bounces that'd return
to an account that has an unconditional automatic forward would loop.

Semantically, for automatic forwards it makes more sense that the
original sender gets the error messages. For manual forwards, it makes
sense that the one who did the forward gets the error message. And the
current state of affairs reflects that.

That's a reason why not even those who propose SRS suggest that if
I have the accounts for(_at_)ward(_dot_)example, with a .forward containing
"hannah(_at_)somewhere(_dot_)example", the envelope sender should be
for(_at_)ward(_dot_)example after the forwarding step, but something else
@ward.example (or similar), which reaches back to the *original* sender.

Those that don't IMO are broken and should be fixed. There is no point in
saying "Well they might not fix it" because its just an argument to not do
anything at all. Some issues cannot be solved without someone somewhere
fixing their broken software.

If fixing means rewriting the envelope sender to "for(_at_)ard(_dot_)example"
in my example for automatic forwards, it *isn't* fixing in the first
place. If fixing means SRS, it might happen, but it takes time, and then
it'd make sense to use -all and to reject on the base of that *only then*
(i.e. after the very most forwarder sites have implemented SRS).

For what its worth, my companies products work correctly :), when forwarding
messages the envelope becomes that of the mailbox doing the forwarding.
There is no room for error, misuse or confusion. If we have been doing it
for 10 years why cant everyone else, FHS its not rocket science.

How do you deal with automatic forwarding? And with the bounce loop
described?

Kind regards,

Hannah.


<Prev in Thread] Current Thread [Next in Thread>