Blocking forgeries and spam with SPF [LWN.net]

Blocking forgeries and spam with SPF

Posted Oct 23, 2003 17:45 UTC (Thu) by edstoner (guest, #4496)
Parent article: Blocking forgeries and spam with SPF

Won't all spammers just then use a utility (i.e. dig) to get the SPF info for the domain they want to specify in the FROM: and use that info to get a valid address?

to post comments

Blocking forgeries and spam with SPF

Posted Oct 24, 2003 3:15 UTC (Fri) by skybrian (guest, #365) [Link] (1 responses)

But to use that information, they have to forge the IP address in the TCP/IP connection to sendmail. Or break into a trusted machine. Both are harder than forging email addresses now, so it raises the bar a little.

Blocking forgeries and spam with SPF

Posted Oct 24, 2003 10:40 UTC (Fri) by liw (subscriber, #6379) [Link]

I have not yet studied SPF and can't comment on it in detail. I will have to read about the proposed solutions for e-mail forwarding systems (I use one such).

A minor point, however: I don't think SPF will stop spam, it will just take things to the next level. In the progress, the amount of spam might reduce, but possibly not.

Spammers can use virus and worm techniques to break into random workstations, which have the right to send mail using some valid, trusted mail server. They can then send spam despite SPF. Suppose the workstation is foo.example.com and the mail server is mail.example.com. The spammers can forge sender addresses to be @example.com, and SPF checks will not help.

I seem to recall a news article somewhere about a group of criminals selling exactly that kind of service to spammers, though I don't seem to have bookmarked it. They claim to control a few hundred thousand workstations, and given the ease in which viruses and worms spread, getting new ones probably won't be a problem.

Thus, widespread adoption of SPF might result in much higher levels of computer break-ins. This will, hopefully, in the end, result in better overall security. *That* might drastically remove the amount of spam, but it might also just cause spammers to invent yet more workarounds.