Blocking forgeries and spam with SPF

Blocking forgeries and spam with SPF

I don't think there should be a significant number of false positives (at least, that don't get resolved), because domains won't add spf until they actually mean to, which will probably be prompted by problems caused by forged addresses.

The tricky part, I believe, is actually handling forwarding addresses. If you run a domain which has any addresses which are supposed to receive mail and forward it to some other address (where it is actually read), it will be tricky to support sending mail legitimately from that address, and it will be tricky to use spf for any other addresses in the domain.

Of course, one possibility would be to set up the machine to relay for a forwarding address if its domain has spf and the message is coming from an authorized host, but that depends on the user's reading domain having spf set up (and requires the user to configure their mailer to relay through the right place).

I don't think it would be a problem for vanity domains (in the sense of "x@y.name" is actually really "xy@isp.com", where isp.com handles everything, and there is not a separate SMTP server for y.name, just an MX record which points to isp.com).

It would be a problem for webmail people who want to send through a different interface, but that's either something the webmail sites don't like anyway, or something they could support (by allowing relays from authenticated users using the SMTP-POP/IMAP hack).