Daniel Taylor wrote:
Don't bounce messages back to a site if the IP that submitted the
address fails SPF for that site. Just drop the bounce into /dev/null.
I would say don't accept it at all
Yes, and that's correct. Publishers of SPF FAIL expect to get "good
bounces" when they meet the "old forwarder - clueless user - next hop
at third party rejects SPF FAIL" scenario. Or similar cases.
A rather convoluted case: Before Google finally managed that I sign
up for a GMail address because I wanted to use a feature that's only
available for GMail accounts they used an @xyzzy address as my main
address (not nobody(_at_)xyzzy :-)
And at that time I wanted to "invite" another person (actually me,
but at a completely unrelated GMX address) for some collaboration
tool (custom search or spreadsheets, it doesn't matter). Of course
I had configured the GMX address to reject SPF FAIL.
Of course Google (ab)used my @xyzzy address as return path for the
invitation. Of course GMX rejected the SPF FAIL as I wanted it, and
FWIW still want it. And not so obvious, Google bounced it then to
my @xyzzy address, behaving as if they were an "old forwarder" for
this invitation. Finally I got the bounce, all working as designed.
But if GMX or Google had silently dropped the FAIL I'd have no clue
what went wrong. Silently dropping mail is dangerous, you've to be
very sure that nobody wants the bounce, or rather that the address
noted in the return path doesn't want it.
The easiest fix in this example: Get that d****d GMail inbox and
share it with Googlebot if you want Google to send "mail from you".
You're not forced to use it for remotely "private" mail.
Frank
-------------------------------------------
-----------------------------------------------------------------------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?list_id=735
Powered by Listbox: http://www.listbox.com