spf-discuss
[Top] [All Lists]

RE: SpamCop recommends SPF (and/or DomainKeys)

2005-01-27 06:46:02
-----Original Message-----
From: owner-spf-discuss(_at_)v2(_dot_)listbox(_dot_)com
[mailto:owner-spf-discuss(_at_)v2(_dot_)listbox(_dot_)com]On Behalf Of Nick 
Phillips
Sent: Thursday, January 27, 2005 1:57 AM
To: spf-discuss(_at_)v2(_dot_)listbox(_dot_)com
Subject: Re: [spf-discuss] SpamCop recommends SPF (and/or DomainKeys)


On Wed, Jan 26, 2005 at 07:07:37PM -0500, Stuart D. Gathman wrote:

We need to work on the public perception of SPF being unreliable or
error-prone.

I've seen two things referenced wrt SPF being "unreliable":

1) mistakes by SPF publisher, buggy SPF client software, and/or
   incorrect receiver forwarding configuration causes
   incorrect results.

2) publisher can specify results of NEUTRAL or SOFTFAIL.

I forgot:

3) User expected SPF-classic to verify 2822 From, but it doesn't.  We
   can blame senderID for that misconception.

Apart from these, perhaps some of the perception comes from the fact that
they've been "sold" on SPF as an anti-spam system. But I expect most of
it comes from the forwarding problem (i.e. that too many forwarders slag
off SPF).


My experience on spf-help is that it's a mix of four things (in rough
frequency order - not based on statistics, just my impression):

1.  Someone other than the domain owner (e.g. ISP or registrar) published
the SPF record without involving the domain owner

2.  SPF checking MTAs don't whitelist non-SRS forwarders

3.  Bad record/Buggy or misconfigured checking programs

4.  Web based senders using non-local mail from:

Scott K