On Wed, Feb 18, 2004 at 12:31:08PM +0300, Odhiambo G. Washington wrote:
> Hello All,
>
> We receive a lot of spam with forged sender addresses bearing domain
> names hosted by Outblaze. I have spoken to the man in the driver's
> seat at hotblaze (Hi Suresh) and he's given me some valuable advise.
> However, I am tempted to think that these forgeries are not a preserve
> of our users only, and being an ISP, I wanted to know if others have had
> success stories fighting the forgeries and how they have done it.
> DNSBLs just don't seem to catch all of them here.
The problem with SMTP is that any host can connect and send mail with
any sender address, hence the ease of forgeries.
One solution that seems to be catching on fast (and is being adopted
by some biggies such as aol.com), is the "senders permitted from"
mechanism. It's described here:
http://spf.pobox.com
I think I read an archive message describing how to implement SPF
checking in exim, using ACLs, and if Outblaze were to implement SPF,
then you could eliminate the forged emails very easily.
I'm hoping that yahoo, hotmail and other large ISPs will also adopt
SPF. But yahoo seems to be working on its own scheme to stop
forgeries, and we'll have to wait and see what they propose. However,
if enough people are using SPF, then I think Yahoo could be convinced
that it's a good thing, and adopt it as well.
--
Anand Buddhdev
