Julian Mehnle wrote:
Such a mechanism, if it was part of the SPF record, would be
authentic by definition because it would be under the direct
control of the domain owner (who controls the SPF record).
Not sure what you're talking about. The semantical difference
"v=spf1 +all" and "v=spf1 op=auth +all" is "all your base are
belong to us". Senders are free to claim whatever they wish.
Adding a trust=me modifier to a policy changes nothing. Bye