SPF should be killed [LWN.net]

SPF should be killed

Posted Jul 14, 2005 20:13 UTC (Thu) by copsewood (subscriber, #199)
In reply to: SPF should be killed by ahoh
Parent article: Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

If you send your mail direct to the MX of the recipient, why not just create SPF records for your outgoing domains pointing to the machine you send this mail from ?

If you and many others send legitimate mail for these domains from different machines with different IP addresses, and these domains have all authorised different outgoing relays and your IP address varies, then I accept that this is more of a problem. Most travelling salesmen sending email from hotel rooms only need to send for 1 domain, in which case authenticating to the relay authorised by this domain is going to be the same regardless of where you send from.

to post comments

SPF should be killed

Posted Jul 16, 2005 10:55 UTC (Sat) by DennisJ (subscriber, #14700) [Link] (1 responses)

I have users who for verious reasons prefer to use addresses from their home isp or some webmail service instead of the address we offer them, but send through the server I administer when they are here.

Unless I'm completely missing something, there's no way for me to set up SPF records for those domains, I just see a lot of work for me if SPF really catches on.

SPF should be killed

Posted Jul 16, 2005 15:47 UTC (Sat) by copsewood (subscriber, #199) [Link]

The more recent CSV proposal seems likely to be more secure and simpler than SPF, but with SPF its the domain owners who decide which server can legitimately send mail on that domains behalf, and it is up to them not you either to provide relaying facilities, or to authorise your relay for their domain. If you must block outgoing port 25 to all addresses but your own mail relay server, make sure that you leave 587 open, so they can use the authenticated MSA relay setup by their domain owner for this purpose. Webmail domain owners may or may not provide 587 MSA facilities - but that is between them and their users. If they have you delegated as the technical contact for the domain, all you have to do is add a DNS SPF record for the domain delegated to point to your own relay.

Personally, having read about this in the last few days, I think the CSV approach will be simpler for admins than SPF and possibly avoid potential denial of service security problems which the SPF macro expansion capabilities allow for. With CSV the DNS setup looks simpler, and if you relay customer mail outgoing in respect of their own domains you just HELO as your own domain, listen to the abuse address at the domain you HELO as and take responsibility for what you relay.