<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Kevin Miller wrote:
<blockquote
cite="midD1587DCF6294524BAFA2C9944312FCC863BD88@city-exch-w3e.cbj.local"
type="cite">
<pre wrap="">Matt Kettler wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Kevin Miller wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Matt Kettler wrote:
</pre>
</blockquote>
<pre wrap="">snip
It's gotchas like that which make me suggest starting off at neutral.
Even though you can reliably know what machines SHOULD be allowed to
send mail from your domain, you might have servers that DO send mail
from your domain even though they should not that provide critical
business services.
</pre>
</blockquote>
<pre wrap=""><!---->
I understand the problem, but I'm still unclear on how one test for it.
If you put up a domain with neutral or softfail, how do you know when a
hit occurs? If I spoof your domain and send to a third party, they'll
either silently drop the email or send 550 back to me. How do *you*
know when it's safe to walk a neutral up to softfail and from there to
hardfail? When I first installed spf in my dns I searched all over the
spf web site for clues on how folks are doing that. Never found
anything...</pre>
</blockquote>
<br>
There is no way to test what other users are doing with your SPF info.
You can only look at your user complaints about mail they sent that was:<br>
<br>
1. undelivered<br>
2. marked as spam by someone else's spam filter<br>
<br>
And you can look at the number of bogus virus and spam bounces you
receive.<br>
<br>
All of this is unreliable at best. You're relying entirely on a
statistical evaluation of your problem reports, trying to determine
whether they've changed between your different SPF entries. For most
of us, we have nowhere near the volume of mail (or problem reports)
that would be necessary to get a meaningful result from such analysis.<br>
<br>
I suppose that you *could* fire off a few huge spam runs spoofing your
domain from a third party server (or a botnet) and see how many of your
messages get accepted with each of neutral, softfail and hardfail
set. I don't think I'd want to use this test. :)<br>
<br>
Rick<br>
</body>
</html>