Blocking forgeries and spam with SPF

Blocking forgeries and spam with SPF

I have not yet studied SPF and can't comment on it in detail. I will have to read about the proposed solutions for e-mail forwarding systems (I use one such).

A minor point, however: I don't think SPF will stop spam, it will just take things to the next level. In the progress, the amount of spam might reduce, but possibly not.

Spammers can use virus and worm techniques to break into random workstations, which have the right to send mail using some valid, trusted mail server. They can then send spam despite SPF. Suppose the workstation is foo.example.com and the mail server is mail.example.com. The spammers can forge sender addresses to be @example.com, and SPF checks will not help.

I seem to recall a news article somewhere about a group of criminals selling exactly that kind of service to spammers, though I don't seem to have bookmarked it. They claim to control a few hundred thousand workstations, and given the ease in which viruses and worms spread, getting new ones probably won't be a problem.

Thus, widespread adoption of SPF might result in much higher levels of computer break-ins. This will, hopefully, in the end, result in better overall security. *That* might drastically remove the amount of spam, but it might also just cause spammers to invent yet more workarounds.