SPF and MailScanner

[Spicer, Kevin]

Julian Field wrote:
> At 10:09 30/01/2004, you wrote:
>> Just read a good piece in NANAE about reasons why SPF will not going
>> to work. At least for a whole lot of people and (small) bussinesses.
>> 
>> Eventually you would have to include all IP-addresses in the list
>> from where your domain can be used to send e-mail. Or restrict the
>> use (and ease) of e-mail.

I thinks thats the crux of the matter.  But its a point of view as to whether that is a problem caused by SPF, or one of the causes of the current problems with forged senders that needs to be addressed

There is a page addressing common objections to SPF on their site http://spf.pobox.com/objections.html


> I have yet to see a solution to the problem that actually will work
> in real life. SPF requires me to keep track of all the IP addresses
> of every outgoing-mail-server used by BTInternet, for example.They
> change their setup (for maintenance or whatever) and all of a sudden
> all my mail is rejected. Yeah, great idea :-(

Having read (some) of the detail of SPF that seems a relatively straightforward problem and is already addressed in the specification.  Assuming that BTinternet were to publish spf records for their domains you can simply set an 'include' directive to use their spf records for your domain.

I'm not saying that SPF is the answer, but that it does seem to be gaining some momentum and may be useful in some cases if not all.  Even if it isn't universally accepted it will still be useful to help detect forged senders from some domains - even if this only means we increase the SpamAssassin score for those mails.

Of course what we really need is a properly designed, secure, mail system (i.e. scrap SMTP) - but the barriers to this get higher every day so we may have to wait until hell freezes over AND universal adoption of IPv6!



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.