On Thu, Jun 02, 2005 at 05:31:55PM -0700, Dennis Willson wrote:
I'm beginning to see more SPF HELO fails for good email from some places
I would have thought would know better. I got a number of those from IBM
corporate mail servers (and other places too). I don't reject on a HELO
failure, just mark it and send it on so I didn't miss anything. Is it
worth trying to contact domain owners and let them know about this type
of failure?
I really encourage people to use SPF as much as possible, but people
must use it "properly" so others (me) can depend on the validity of any
failures (to me the SPF FAIL is the most important aspect).
What has SPF to do with this?
If you want others to check your SPF record, you make sure your
HELO is configured properly. If you don't allow yourself to use
your name in your HELO, you are shooting yourself in the foot.
If you receive mail from a machine saying "HELO ibm.com" and
"ibm.com" has no SPF record, you shouldn't filter using SPF.
If "ibm.com" does have an SPF record and the host is not allowed
to say "HELO ibm.com", you should (or: could, or may) reject
the connection as it is ibm claiming this host isn't authorized
to use ibm's name.
Alex