In
<1120493108(_dot_)19467(_dot_)74(_dot_)camel(_at_)hades(_dot_)cambridge(_dot_)redhat(_dot_)com>
David Woodhouse <dwmw2(_at_)infradead(_dot_)org> writes:
On Sun, 2005-07-03 at 23:10 +1200, Lennon - Orcon wrote:
Forwarding / SRS is the big killer of SPF at the moment.. more people
have to start using SRS. (how many commercial mailers (or even
non-commercial do) by default?
There isn't even an internet-draft being put forward which standardises
SRS.
SRS is a local policly used by forwarders. It is not a protocol.
Therefore, it is not critical that there is an I-D, or RFC or
whatever.
VERP is used all over the place for mailing lists, and it isn't in an
RFC. The ORCPT ESMTP option, which was created to solve the same
problem that VERP solves, has an RFC and yet lacks widespread support.
It seems to be entirely dead in the water, and yet it needs to be
done _before_ any official blessing of SPF can (sanely) take place.
Well, that may be your opinion, but it isn't mine.
There are many ways of solving the "forwarding problem", SRS is just
one of them. Several other methods are (very briefly) outlined in
http://www.schlitt.net/spf/spf_classic/draft-schlitt-spf-classic-02.html#forwarding
Forwarding is something that can't properly be tracked by _either_ the
sender or the recipient, in the general case. My ISP certainly doesn't
have any way to tell how many of its customers forward mail to its
servers, or from where. Hence they know perfectly well that they'd lose
business if they were silly enough to reject mail for an SPF failure.
The receiving MTA can often automatically identify forwarding
relationships by doing some per-user analysis. If a given HELO domain
or IP address sends mail that rarely passes SPF checks, and there is a
consistent 2822.To: email addresss that is common only to that
particular user, and the HELO domain/IP address is not normally a spam
source, then it is likely that the email address identified on the
2822.To: line is being forwarded.
-wayne