Blocking forgeries and spam with SPF

Blocking forgeries and spam with SPF

My first thoughts as an author of a minor anti-spam program and as a victim of spam pretending to come from my own domain , were that an approach like this could not work because of a catch 22: people won't implement blocks on this basis if there are many false positives, and if there are few blockers, DNS admins have less incentive to update their domains.

Further thoughts suggest that blocks probably can be usefully implemented on the easiest targets. These are likely initially to be faked mail coming from servers not belonging to the most heavily used mail domains on outgoing envelope headers, e.g. Hotmail and AOL. This would make it more difficult for people legitimately using Hotmail and AOL addresses from sending their mail from other clients on other networks but very few legitimate web-mail users would know how to do this, and those who wanted to do this would very soon acquire more reputable addresses. Spammers would then choose other domains to fake, but this fact provides a good incentive for any domains which don't want to be faked to update their DNS records and provide access to authenticated outgoing SMTP relays for their legitimate users.

Whether this succeeds in having a wider network effect might depend upon how many people are willing to block all mail coming from all domains which don't have the required DNS records, as well as all mail coming from unauthorised relays from domains with the required DNS records. The problem here is that the first people to block in this manner risk having a very high false positive rate to start with.

This proposal also only provides a start to prevent some of the worst abuse. When spammers have to use their own domains to send their spam, we will still need to be able to coordinate reporting and blocking of these spamming domains and relays, but hopefully this will make this job a bit easier.