terry at ashtonwoodshomes
Feb 10, 2011, 12:15 PM
Post #6 of 7
There is still a point, because although some ESP's may not block
Re: Yahoo mail and Gmail policy explanation?
[In reply to]
forged/non-existent domains, many mail servers do, more and more.
And more and more use SPF as an indicator toward spam (which is often
forgery) or not.
So having an SPF record can help your domain get successful delivery.
And can help you from some forgery should it ever sneak up on you.
I am all for "do not fix something that is not broken",
but remember also that "an ounce of prevention is worth a pound of cure".
SPF may be that ounce of prevention.
terry [at] greatgulfhomes
Associate Director Software Development and Deployment
Great Gulf Homes / Ashton Woods Homes
Fax: (416) 441-9085
On 2/10/2011 12:33 AM, Martin Jericho wrote:
> Hi Stuart,
> Thanks for your explanation - although I'm not convinced about the
> If Google and Yahoo just allow email from invalid domains because
> there are too many incorrectly configured sender mail servers,
> wouldn't the same argument mean they also just ignore SPF because
> there are so many incorrectly configured SPF records? From the
> evidence I've seen they do check SPF records for real domains but just
> let fake domains through without even marking them as spam.
> If all mail servers did the sensible thing as mentioned here:
> http://www.openspf.org/FAQ/Blocking_spam, and all domains had SPF
> records, spammers would indeed have a hard time. The fact that Google
> and Yahoo allow fake domains through really makes SPF completely
> impotent as a weapon to fight spam. In the cartoon guide
> (http://old.openspf.org/aspen.html) this would be represented by a
> huge bell curve called "fake domains" that dwarfs the other two and is
> a free ticket to spammers.
> The fundamental question I'm trying to get at is:
> Should I bother setting up and maintaining SPF records if my domains
> are not currently suffering from any forged identity problems? I would
> do it happily if it contributed to the internet community's fight
> against spam, but unless major email service providers close the fake
> domain loophole, there doesn't seem to be any point.
> ----- Original Message ----- From: "Stuart D. Gathman" <stuart [at] bmsi>
> To: <spf-discuss [at] listbox>
> Sent: Thursday, February 10, 2011 12:31 PM
> Subject: Re: [spf-discuss] Yahoo mail and Gmail policy explanation?
>> On Thu, 10 Feb 2011, Martin Jericho wrote:
>>> Neither yahoo mail nor gmail seem to reject incoming mail if there
>>> is no DNS
>>> record at all for the envelope sender address, allowing spammers to
>>> just use
>>> completely fake domains.
>>> Does anyone know why they might choose to have that policy? Is there
>>> legitimate reason for allowing incoming mail from a fake domain? It
>>> even get blocked when you turn on the spam filter!
>> Believe it or not, there are countless clueless, but otherwise
>> senders who can't get basic things like HELO or MAIL FROM right (much
>> less SPF). Our customers get such mail rejected from their customers
>> month or so. We immediately search the logs, find what brainless
>> thing their
>> customer is doing, attempt to send mail to postmaster (which usually
>> because they are after all clueless), and add a special "whitelist"
>> "accept mail from invalid domain email-clueless.com" and hope
>> spammers don't
>> use it).
>> Free email outfits like yahoo or gmail simply can't afford to offer this
>> kind of email tech support. Their system has to be entirely self-serve.
>> Statistically routing mail to a "spam" folder is something end users
>> can handle on their own when it doesn't do what they want. Diagnosing
>> what what idiotic thing this particular sender did, and constructing
>> a complex whitelist to work around it is not something end users can
>> It is *not* as simple as "whitelist this email" when the domain is
>> or forged.
>> If there was a particular email, then a "Whitelist" button could run
>> heuristics to identify common sender problems and apply standard
>> But if there was an email, then our customer would not be complaining!
>> The first problem is *finding* what random invalid domain the stupid
>> sender is trying to use in the log. In the case of my church, for
>> they simply had a typo in their MTA config for the MAIL FROM (and
>> they rewrote the MAIL FROM of all client submissions with the wrong
>> If people would just send a test email to something like
>> spf-test [at] openspf
>> after configuring their server, things would be so much easier.
>> It would also be nice if they tested their SPF record on openspf.org
>> before publishing it.
>> Stuart D. Gathman <stuart [at] bmsi>
>> Business Management Systems Inc. Phone: 703 591-0911 Fax: 703
>> "Confutatis maledictis, flammis acribus addictis" - background song for
>> a Microsoft sponsored "Where do you want to go from here?" commercial.
>> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
>> Modify Your Subscription: http://www.listbox.com/member/
>> Archives: https://www.listbox.com/member/archive/735/=now
>> RSS Feed:
>> Modify Your Subscription: https://www.listbox.com/member/?&
>> Unsubscribe Now:
>> Powered by Listbox: http://www.listbox.com
> Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
> Modify Your Subscription: http://www.listbox.com/member/
> Archives: https://www.listbox.com/member/archive/735/=now
> RSS Feed: https://www.listbox.com/member/archive/rss/735/1068817-8ce620fc
> Modify Your Subscription:
> Unsubscribe Now:
> Powered by Listbox: http://www.listbox.com
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
RSS Feed: https://www.listbox.com/member/archive/rss/735/1311532-17d8a1ba
Modify Your Subscription: https://www.listbox.com/member/?member_id=1311532&id_secret=1311532-f2ea6ed9
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=1311532&id_secret=1311532-bdbb122a&post_id=20110210151545:A2B08054-3552-11E0-8456-1A52F559ED1D
Powered by Listbox: http://www.listbox.com