spf at beer
Jan 15, 2007, 3:49 AM
Post #21 of 51
(8872 views)
Permalink
|
> What I've learned so far: there is no optimal SPF record.
And there couldn't possibly be.
SPF is a mechanism for describing how you send mail. As there is no single
universal way of doing mail services - you send mail in an entirely
different way to me, for example - there can be no single universal
description of the way mail is sent.
> If I use "a"
> my host could change servers, if I use "mx" then my host could
> redesignate servers, if I use ''ip4'' my host could change IP addresses.
I think you're putting the cart before the horse.
Before getting bogged down in the minutiae of SPF syntax, I think you'd
benefit from writing down - in your own, natural language - how you would
describe your outbound mail systems. Pay particular attention to naming
those servers who *will* be sending on your behalf, those who *won't* be,
and those who might, but also send on behald of other people.
> SPF records are a non-unique, partial solution to this problem. I get
> that.
No - SPF records are a full solution to the problem they address.
Unfortunately, you're not yet in a position to deal with that problem.
> It is becoming obvious that SPF is falling very short of the mark for
> authenticating email.
Sorry, Scott. That might be obvious to you, but it is not at all obvious
to me.
> Authentication tied to IP addresses isn't enough.
It's not a FUSSP, if that's what you're saying.
http://www.claws-and-paws.com/fussp.html has a form (sadly, already filled
in) which covers a range of explanations of why a FUSSP is not possible...
> My host provider has some 150 domains on our server. I have no idea
> how many shuttle email through the email servers, but it's got to be a
> bunch of people. So some SPAM operator, hosted by my hosting company,
> could use a PHONEY[at]randsco.com email address and blammo ... it'd PASS
> SPF scrutiny, because we happen to be using the same/shared email
> servers.
This is cross-forgery. And I think you've misunderstood how to tackle it.
- If you suspect a server might be susceptible to such abuse - don't give
it a SPF PASS. I'd give it a SPF NEUTRAL.
- If you have any evidence of cross-forgery occurring, complain to your
provider. Generally speaking, they'll tackle this sort of problem very
quickly - if they don't, you picked the wrong hosting company.
- Mail servers for vanity domains rarely handle much traffic - my
approach is to run mail services from a mail machine physically housed
with the users. There's no need for it to be the same machine as runs the
web site.
> (Not to mention the problems with email forwarding).
Such probolems are easily solved - don't forward email. There are very few
reasons to.
> My frustration stems from the fact that there's no galvanizing answer or
> way to build an SPF record for someone, like myself, utilizing a hosting
> provider.
That's like saying that there's no way to build a French sentence to
describe which servers send your email. It's an incorrect statement - but
the problem isn't the language you use to describe the situation (whether
French, English, or SPF), it's the fact that you need to determine what
you want to say before you worry too much about how to say it.
> It would seem that SPF is a solution mainly geared toward
> people who DO have control over their internet mail servers.
Only in as much as those that control their mail servers have more control
over their mail - it's not that SPF only supports them, the reason the
scenario is easier is because they don't have to deal with other people
supplying them incomplete or incorrect information, and they don't have to
deal with other people changing the setup without informing them.
> What assumptions am I making that are incorrect?
>
> I do not expect my incoming and outgoing email servers to remain the
> same.
You *could* ensure that they are. This will mean a little thought, but you
might be able to convert to such a setup for no outlay.
> I do not expect my IP addresses to remain the same.
Which IP addresses? Your mailserver really ought to have a fairly stable
address.
> Please help me build an SPF record that stops spammers from stealing my
> domain's identity!
There are many people here who will help you - but to start with, *you*
need to sit down and write down what you want to say in your record. Then
one of us can help you with the SPF syntax.
Vic.
-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca
|
1
