spf-discuss
[Top] [All Lists]

Re: [spf-discuss] How reliable is it to block/reject on SPF fail?

2009-11-30 06:11:22


--On 28 November 2009 11:41:55 -0500 "Stuart D. Gathman" <stuart(_at_)bmsi(_dot_)com> wrote:

On Fri, 27 Nov 2009, Ian Eiloart wrote:

> server or fetching by the other one. Gmail and many other servers offer
> fetching: it is the solution with fewer problems.
>

Except that it requires you to Gmail to store your password for the
remote account in a recoverable format. For our users, that means
violating our terms and conditions of use. In fact, we'd not permit them
to share our passwords with Gmail even if Gmail were storing them
securely. We have a common authentication mechanism that means you can
do more with the password than just read email.

I've always wondered why more users don't just run their own mail domain,
and either buy Exchange for Windows or run an open source OS.

But then I remember how frustrated I get with all the supposedly
professional email providers that don't know diddly squat about RFCs and
cause all kinds of trouble.

And while a 3rd party service could give you your own domain for a
few bucks a month (for small volumes), it is hard to compete with "free"
(as in beer).

Is it even possible to have an open source (or even proprietary) email
server that even the most rfc ignorant can successfully configure out of
the box? Perhaps it would include a system where every installation would
be automatically tested (remotely using only SMTP related ports and by
having the new install send test emails to designated servers) by other
accepted installations, and only activated when it passes.

The problems? I always look to the analogy of the car. When they first came out, you needed a chauffeur with technical skills to repair the vehicle they were driving. Now, almost anyone can buy a reliable car and learn to use it with a few hours lessons. Those lessons, though, are basically about learning not to drive your car without killing yourself or anyone else. Very few people though have the skills and the inclination to build even the simplest kit car.

We're at that point with the Internet. The biggest stumbling block with roll-your-own mail server is probably the question of where you get an IP address that isn't on an RBL. Frankly, I'm very pleased that a large proportion of the IP space is protected by policy block lists, and would not want millions more home PCs permitted to emit unauthenticated mail on port 25 (especially Windows, but other OS too).

So, you'd probably want these domains hosted on some other mail server. Google hosts my domain for free - I just pay the registration cost. I have a virtual host, but can't be bothered to run my own mail server on it.

--
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/


-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ 
[http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/735/=now
RSS Feed: https://www.listbox.com/member/archive/rss/735/
Powered by Listbox: http://www.listbox.com

<Prev in Thread] Current Thread [Next in Thread>