SPF: yes, ma'am

Posted Jun 15, 2006 16:42 UTC (Thu) by zmi (guest, #4829) [Link]

People keep believing that SPF is to filter SPAM. That's not the target.
SPF can *only* say if an e-mail is forged or not.

If you setup in SPF that from lwn.net only host 1.1.1.1 is allowed to
send, and some server checks SPF and gets a mail from lwn.net from host
2.2.2.2, then it can discard it as forged. That's it.

The fact that SPAM very often sends with forged addresses is just a side
effect. There are other tools for SPAM.

Posted Jun 15, 2006 16:53 UTC (Thu) by iabervon (subscriber, #722) [Link]

It's not surprising that it can't distinguish spam from ham, because it wasn't designed to distinguish spam from ham, contains no support for doing that, and the specification states that it does not do that. It is intended exclusively to distinguish forgeries, and spam is relatively rarely forged. It isn't intended to provide any benefit to the recipient; it's intended to benefit the innocent third party whose address the forger is using.

Of course, it's too soon to use it; the rest of the email system is still such that legitimate operations are standardly done by essentially forging email. At present, there is no standardized and reliable mechanism for a desktop MUA to submit email to the system in a way that authenticates the sender (as controlling the reception of email to the address). And there's the mess with transparent forwarding. (I think SMTP is essentially just a big mess, like a lot of its contemporary protocols, which were done before people had a good understanding of how to design application-layer network protocols effectively.)