SPF, Domain Keys, and the like [LWN.net]

SPF, Domain Keys, and the like

Posted Jul 1, 2004 8:57 UTC (Thu) by job (guest, #670)
In reply to: SPF, Domain Keys, and the like by kitterma
Parent article: Large ISPs ponder spam

That is not true!

What's in their "From" address is completely uninteresting. Not only does
this not tell us anything about the spammmers whereabouts, it is also
very easy for spammers to create disposable addressses to evade
blacklists. Some people used to black list the "From" addresses but it
was a very bad idea and nobody does it anymore.

The source IP, on the other hand, is VERY interesting. Just "whois" the
IP and phone or mail the guy to stop (in practice, you mail his/her ISP
to shut them out). There are even services that can do this very easy for
you with a friendly web interface, like http://spamcop.net/ .

Adding SPF to that accomplishes ONLY that you can delete false bounces,
_nothing else_.

(Log in to post comments)

SPF, Domain Keys, and the like

Posted Jul 1, 2004 12:27 UTC (Thu) by kitterma (subscriber, #4448) [Link]

Today you are right. All blacklists work on the basis of the IP address because the From: (and other) addresses are virtually always forged.

I published an SPF record to try to protect my domain name from accusations of spamming. I'm not there yet as today publishing a -all record is a challenge, but the technology is in its infancy. I'll get there.

SPF is primarily about making forgery more difficult (including phishing). As far as spam goes there are only 3 possibilities:

SPF fail: It's a forgery - do not accept during SMTP session
SPF unknown: Don't know - keep on processing like there is no SPF
SPF pass: It's not a forgery, so now I know this is a spamming domain.

Yes, domain based blacklisting hasn't worked in the past because of forgery. SPF makes domain based blacklisting possible. Yes, spammers will get throwaway domains, but this does raise the transaction costs.

SPF isn't envisioned as a final solution to spam. It is a step.