Szerző: Graeme Fowler Dátum: Címzett: exim users Tárgy: Re: [exim] Alias to external server and SPF failure
On Sun, 2010-05-23 at 17:48 -0400, W B Hacker wrote: > And probably would still do so even if 100% of the 'proper' smtp world published
> such records, simply because WinBots will not.
But... you don't know that.
For any domain that publishes an SPF record, there is a finite (and
growing) chance that a bot or trojan will attempt to use an address
within that domain as a sender address.
*That* is what SPF is all about: forgeries.
Hypothetical example: I register example.com. I provide an SPF record of
"-all" for example.com, which means "this domain does not send email". I
also publish an address for people to send *to* - hell, say,
postmaster@???.
Imagine an outbreak (it's not very hard) of a bot within a corporate
network. These are hosts behind a NAT firewall, forced to send via
Windows group policy via a local authenticated SMTP gateway. The bot
uses the corporate policy to send junk via the corporate mail gateway
using someone's credentials.
Eventually, the bot uses postmaster@??? as the sender address.
Everyone using SPF on inbound mail has their MTA say "whoa, this domain
uses -all, go away" after only a couple of lookups - or even after only
one.
I appreciate that the SPF Kool-Aid is strong on the "this is the
solution" side (or at least it was), which seems to make arguing for SPF
a weak exercise; however on the flip side the "SPF is a complete waste
of time" is just as weak.
SPF has its place. Don't discount it just because a number of loud
voices on both ends of the argument make vociferously opposing points -
the middle ground, as per usual, is where it's at.
rDNS is not the solution. It isn't even a decent placebo - and neither
is SPF. But in conjunction they can (and do) work fairly well; added to
other checks they work even more accurately.