spf-discuss
[Top] [All Lists]

[spf-discuss] Re: Forwarder whitelisting counter-proposal: SPF "i-am=" modifier

2008-01-09 06:00:27
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Michael Deutschmann wrote:
On Wed, 9 Jan 2008, Julian Mehnle wrote:
[...] but I don't think _we_ need to care about [AGUPI] use case and
it barely justifies the implementation effort required by your
proposal, especially as it can be solved by something as simple as:

  MAIL FROM:<ralph(_at_)example(_dot_)net:bounce> (or 
<ralph(_at_)example(_dot_)net(_dot_)bounce>)
  RCPT TO:<sarah(_at_)example(_dot_)com> 

That still requires some kind of extension signalling, otherwise your
bounces will be rejected by legacy mailservers that detect you as
forging a domain that doesn't even exist -- or is a syntax error.

Agreed that some kind of extension signalling would be required.  However, 
I am not really concerned about this use case.  If AGUPI ever happens, it 
will likely take another five years.

Also, accomodating AGUPI should be very important to SPF, since for
many people it is SPF's killer app.

I don't think AGUPI will ever rely primarily on SPF, since SPF's support 
for localpart authentication is just too halfhearted.

  MAIL FROM: <sarah+32823667(_at_)example(_dot_)com> 
AUTH=sarah(_at_)example(_dot_)com
  RCPT TO: <ralph(_at_)example(_dot_)org>

Of course this only helps if the receiver has implemented TENBOX/E. 
Do you expect everyone who has implemented greylisting to also
implement that?

If SES or BATV takes off, they'll have to downgrade their greylisting
to only work on a domain basis, or put up with false-positive delays
all of the time.

True, however that may be a major reason for SES and BATV NOT taking 
off. :-/

TENBOX/E, when implemented by both sides, allows both to get timely
deliveries without giving anything up.

Well, even though I don't think that the forwarder whitelisting problem 
warrants something as involved as your TENBOX/E proposal, it may still be 
a useful extension.  Why don't you go ahead and write a more formal draft 
(see [1] for tips on how to go about that)?  You might also want to ask 
the relevant IETF working groups for what they think (Frank is involved 
in some of them and may be able to give pointers).

References:
 1. http://www.openspf.org/RFC_Authoring

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHhMT9wL7PKlBZWjsRAq9uAKDnVHGy+s+ObJfV4UMEjEHWcuYrMQCgpRqc
PaQnw4vCUF0biRt0V9KJ0y4=
=MVjp
-----END PGP SIGNATURE-----

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Archives: http://v2.listbox.com/member/archive/735/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/735/
Modify Your Subscription: 
http://v2.listbox.com/member/?member_id=2183229&id_secret=83638096-d7a2d7
Powered by Listbox: http://www.listbox.com