On Sun, 12 Nov 2006, K.J. Petrie (Instabook) wrote:
I take your point, but is "RCPT TO:" preserved in forwarding? It needs to
contain the original domain in order to work. I'm afraid I don't know enough
about SMTP to answer that. I'm just an ordinary domain owner who's scared SPF
will wreck my mail receipt arrangements. In order to have "another round of
verification", though, don't we need the DATA portion to be completed, which
is not much good if the policy applied to an SPF FAIL has already rejected
the message?
Ignore my previous mail, you actually wanted the receiver to publish
a policy.
SPF is opt-in for both senders and recipients. It's not going to
wreck your mail receipts unless you foolishly decide to start checking
SPF without configuring your forwarders (and using software that
allows that).
Perhaps, however, you are using a free email service (e.g. hotmail
or gmail) which checks SPF, and while owning a domain, you simply
relay all mail to a free account. Not only that, you don't even run
the relay server, but rely on a forwarding service to relay
the mail. If the forwarding service doesn't do SRS, and the free
email doesn't allow you to configure forwarders or turn off SPF checking,
then you will indeed have problems - but only because you are stuck with
the policies decided upon by the free services (e.g. no forwarder support), and
have very little clout.
The people you need to convince to use your RPF idea is the
free mail services. It really has nothing to do with SPF - it is a decent
suggestion for a way that "vanity" domains can signal desired receiver
policies to such services, but it is private to the mail recipients system
(which in your case includes the free services). It isn't a public
protocol, and could be done differently for each mail service and still be
workable (as long as the policy records didn't conflict). Good luck convincing
free services to flesh out and implement your idea.
Here is my suggestion:
1) at personal volumes, paid SMTP relay services are really *very* cheap, on
the order of 10s of US$ a year. Get one that does SRS.
or (more $$)
1a) use a paid mail service, that will let you provide your own MX records.
Then SPF checking will actually work to your advantage if you just
point the MX records of your domains to the mail service.
or (more $$)
2) get a static IP. This is on the order of 10s of US$ more per month
over what you currently pay for a dynamic IP. Run an SMTP relay with
SRS to forward your own mail to gmail or whatever for storage.
or even (more work)
3) since your machine has a static IP and is relaying the mail, why not
install dovecot (IMAP) and squirrelmail (webmail) also? Why use gmail?
Get a UPS and a few external USB disks for backup.
Basically your complaint is that the everything is "free" model has been
abused out the wazoo by spammers (domain forgery), so there needs to be some
restrictions (e.g. no forwarding support) on free service.
--
Stuart D. Gathman <stuart(_at_)bmsi(_dot_)com>
Business Management Systems Inc. Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flammis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.
-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?list_id=735