[119955] in North American Network Operators' Group
Re: SPF Configurations
daemon@ATHENA.MIT.EDU (John Levine)
Fri Dec 4 12:26:04 2009
Date: 4 Dec 2009 17:25:04 -0000
From: John Levine <johnl@iecc.com>
To: nanog@nanog.org
In-Reply-To: <3c857e1c0912040903l41bccedbo44c1afe269e542d2@mail.gmail.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
>> If the customer insist on using their domain, then you would have to have
>> the customer setup an SPF record within their domain that points to your
>> email server IP blocks.
Right. The only major mail system that pays attention to SPF is
Hotmail, but there are enough small poorly run MTAs that use it that
an SPF record which lists your outbounds and ~all (not -all) can be
marginally useful to avoid bogus rejections of your mail.
As everyone here should already know, the fundamental problem with SPF
is that although it does an OK job of describing the mail sending
patterns of dedicated bulk mail systems, it can't model the way that
normal mail systems with human users work. But so deep is the faith
of the SPF cult that they blame the world for not matching SPF rather
than the other way around, believing that it prevent forgery, having
redefined "forgery" as whatever it is that SPF prevents. As the
operator of one of the world's more heavily forged domains (abuse.net)
I can report that if you think it prevents forgery blowback, you are
mistaken.
For rants about how badly the world and/or SPF stink, followups to
Spam-L. For proposals about other anti-spam magic bullets, followups
to ASRG.
R's,
John
