To be fair though, in mentioning an opt-out system I was thinking of clueful users deliberately running their own servers that would notice within minutes that port 25 had been blocked - not the SMTP AUTH crowd which may be significantly less clued up and not notice why their previously working 'Email Thingy" isn't working anymore. I had the further thought that you could use some higher layer content inspection device to drop all SMTP traffic unless it's either to your own SMTP IP, or part of an SMTP AUTH conversation but that is way less than trivial as you'd need to completely proxy the sessions up until SMTP auth at least.... I'd say it was do-able, but not trivial. Cheers - N.

...

...

Nathan Ward 10/06/2004 2:50:13 p.m. >>>

On 10/06/2004, at 2:43 PM, Perry Lorier wrote:

This breaks SMTP AUTH for people who send mail via another machine on

the Internet, because that host is the only one allowed to send with

SPF.

You conveniently ignored the opt-out system he mentioned. However for such an opt-out system to work, your packet filters would have to adjust themselves as dynamic users log in and out. That would suck. -- Nathan Ward _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog NOTICE: This message contains privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify Allied Telesyn Research Ltd immediately. Any views expressed in this message are those of the individual sender, except where the sender has the authority to issue and specifically states them to be the views of Allied Telesyn Research.