spf-discuss
[Top] [All Lists]

Re: Shared MTA policy implementation idea

2005-05-16 12:48:36

On Mon, 16 May 2005, Stuart D. Gathman wrote:

On Mon, 16 May 2005, Stuart D. Gathman wrote:

Suppose an SMTP service has domain 'service.com' and a client
logs in to SMTP AUTH as 'curly' and gives a MAIL FROM of 
'moe(_at_)example(_dot_)com'.
The service then looks for a DNS A record at:

        moe._using_.paul._at_.service.com._smtpauth_.example.com

As you're targeting it to SUBMIT service, they should already have ways
of determining valid domains from invalid or can just directly do SPF
query on incoming email.

I forgot to mention that if the client is using SRS/SES/VERP/whatever,
then he can use a wildcard:

        *._using_.paul._at_.service.com._smtpauth_.example.com

If he wants to match the user, he'll have to use a custom DNS server
to strip the SES/SRS sig, creating the equivalent of:

        *=moe._using_.paul._at_.service.com._smtpauth_.example.com
        ; not legal bind syntax - means match any name ending with '=moe'.

The above is not possible with any dns server (and not just bind) as wildcard support is very specific to not deligated subdomains and not something like *record.

--
William Leibzon
Elan Networks
william(_at_)elan(_dot_)net