Spammers Most Likely Users Of E-Mail Authentication (TechWeb) [LWN.net]

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 16, 2005 17:44 UTC (Sat) by giraffedata (guest, #1954)
In reply to: Spammers Most Likely Users Of E-Mail Authentication (TechWeb) by dwmw2
Parent article: Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

I guess you're talking about a different kind of validating the from address.

The context of this article is SPF, which is about determining that a From: address in an email, while it may be a valid email address, is not the address of the person who sent the email.

But while SPF provides a way to prove the From: address is genuine, most ham doesn't participate in SPF, so one wouldn't want to reject mail just because SPF failed to validate the from address.

to post comments

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 18, 2005 7:54 UTC (Mon) by farnz (subscriber, #17727) [Link]

SPF validates the "MAIL FROM:" part of the SMTP protocol. Unlike Sender ID, it has nothing to do with the "From:" header of the mail message.

A compliant SMTP server is supposed to return bounces (not rejects) to the address given in "MAIL FROM:"; spammers don't want bounces, so they tend to use false addresses in "MAIL FROM:", while legitimate users do want bounces, so they use genuine addresses in "MAIL FROM:"