-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Stuart D. Gathman wrote:
An SPF pass is useful for whitelisting. You can already blacklist
a domain without regard to forgery, [...]
No, you can't. If I started sending out spam using
(_dot_)(_dot_)(_dot_)(_at_)debian(_dot_)org as the
envelope sender, would you blacklist debian.org?
As soon as you have collected hard evidence that mail _genuinely_ claiming
to come from debian.org justifies a bad reputation for that domain, only
then can you go on to blacklisting any mail whatsoever claiming to come
from debian.org, genuinely or not, without checking its sender address
authenticity. But you can collect hard evidence only based on authentica-
ted sender addresses.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFCzqJ/wL7PKlBZWjsRAvL5AJ0XpOwxaCRVBwb6Jmhgh30AXr1vFQCcDrXN
02D1Hs7buwaEaQ7EHuF3cMg=
=OCzI
-----END PGP SIGNATURE-----