SPF, Domain Keys, and the like

SPF, Domain Keys, and the like

Posted Jul 1, 2004 12:27 UTC (Thu) by kitterma (subscriber, #4448)
In reply to: SPF, Domain Keys, and the like by job
Parent article: Large ISPs ponder spam

Today you are right. All blacklists work on the basis of the IP address because the From: (and other) addresses are virtually always forged.

I published an SPF record to try to protect my domain name from accusations of spamming. I'm not there yet as today publishing a -all record is a challenge, but the technology is in its infancy. I'll get there.

SPF is primarily about making forgery more difficult (including phishing). As far as spam goes there are only 3 possibilities:

SPF fail: It's a forgery - do not accept during SMTP session
SPF unknown: Don't know - keep on processing like there is no SPF
SPF pass: It's not a forgery, so now I know this is a spamming domain.

Yes, domain based blacklisting hasn't worked in the past because of forgery. SPF makes domain based blacklisting possible. Yes, spammers will get throwaway domains, but this does raise the transaction costs.

SPF isn't envisioned as a final solution to spam. It is a step.

---

(Log in to post comments)