I think you might have it around the wrong way. If you were connecting via xtra, and were trying to use telstraclear's smtp server it would fail using this approach, but if memory serves me correctly you can't do this now anyway ( I could be wrong). from the faq: How does it work? Suppose a spammer forges a hotmail.com address and tries to spam you. He connects from an IP address somewhere. When he declares MAIL FROM: , you don't have to believe him. You can ask Hotmail if the IP address comes from their network. (In this example) Hotmail publishes an SPF record. That record tells you how to find out if the client IP address belongs to them. hotmail.com IN TXT "v=spf1 ptr -all" You execute the "ptr" mechanism, which means: find out the hostname of the client; if it ends in hotmail.com, it's legit. If the message fails SPF tests, it's a forgery. That's how you can tell it's probably a spammer. jamie On Sat, 2004-01-24 at 23:11, Barry Murphy wrote:

I don't see how this would work.

Lets say I connect to xtra as my ISP, however I have a clear.net.nz email address and use xtra's smtp server to send my email. This sort of system would block it as being spam because it wouldn't be going through the correct poviders smtp server. One alternative would be to allow pop to smtp auth, but I don't see large providers doing such a thing.

Barry

----- Original Message ----- From: "Jamie Baddeley"

...

http://www.nwfusion.com/news/2004/0122aoltest.html?net

http://spf.pobox.com/

worth looking at....

jamie

On Sat, 2004-01-24 at 23:35, James Spooner wrote:

It occurs to me that SPF could/may fail open, that is, if the domain does not have an authoritive SPF list, then the mail is accepted.

Yep, and that's what I would expect. Otherwise you couldn't implement SPF incrementally.

If however, it does, then it may choose to use SMTP after POP to let arbiturary IP's forward mail through it's legitment servers. Also rememeber that most of the 'big' email providers are web based, which means that this should work well for a good deal of forged addresses. ahh, but I believe that the 'big' spammers don't use http as an interface for a spam run.

Regards

James

---

Paradise:

Trying 203.96.152.32... Connected to smtp.paradise.net.nz. Escape character is '^]'. 220 smtp-1.paradise.net.nz ESMTP Postfix MAIL From: foo(a)bar.com 250 Ok RCPT To: jbs3(a)cs.waikato.ac.nz 250 Ok DATA 354 End data with <CR><LF>.<CR><LF> . 250 Ok: queued as DFF248281B

Xtra:

Trying 203.96.92.131... Connected to smtp.xtra.co.nz. Escape character is '^]'. 220 mta2-rme.xtra.co.nz ESMTP server ready Sat, 24 Jan 2004 23:27:57 +1300 MAIL From: foo(a)bar.com 250 Sender Ok RCPT TO: jbs3(a)cs.waikato.ac.nz 250 Recipient Ok data 354 Ok Send data ending with <CRLF>.<CRLF> . 250 Message received: 20040124102820.NHJT20103.mta2-rme.xtra.co.nz@[<snip>]

I don't see how this would work.

Lets say I connect to xtra as my ISP, however I have a clear.net.nz email address and use xtra's smtp server to send my email. This sort of system would block it as being spam because it wouldn't be going through the correct poviders smtp server.

Which is one of the major sticking points of SPF. There are legitimate uses of "forging" domains like this...

One alternative would be to allow pop to smtp auth, but I don't see large providers doing such a thing.

Well not sure if you mean POP before SMTP or SMTP AUTH, as they're two different things....POP before STMP is hack, and should go away and die, but SMTP AUTH is a sensible way to do it, is supported by nearly all modern email clients, (at the very least, Outlook Express, Eudora, and Netscape support it) and in fact is supported by a lot of ISP's already. How to tell if your ISP supports it ? Easy, telnet to port 25 of your ISP's nominated smtp server, and type: EHLO test if one of the lines includes: 250-AUTH PLAIN LOGIN Then they support SMTP auth. Note there are two different mechanisms for SMTP auth (actually there are some others as well) PLAIN and LOGIN, and your ISP doesn't necessarily support both.

From memory Netscape and Eudora use "LOGIN" and Outlook Express uses "PLAIN", but don't quote me there...

SPF would be reasonably workable provided that the ISP thats added SPF entries for their own domains provided SMTP auth access for their customers. One major hole of SPF or any similar plan though, is that open relays are still going to work as spam conduits - since SPF is an opt in system, any open relay which didnt have an SPF entry could still relay spam, or if they did have an SPF entry, but were accidentally an open relay, spammers would just have to make sure that they used return addresses which belonged to the domain hosted by the open relay in question. The only way around that would be if your mailsystem added a "penalty" for those domains that don't have an SPF entry (for example adding extra points on spamassassin) but that doesn't seem like a very good idea either... One good side would be that those who did list their domains with an SPF entry would be less likely to be the victim of a "joe job", provided that a large enough proportion of the recipients of such spam were checking SPF... Regards, Simon

On Sat, Jan 24, 2004 at 11:33:54PM +1300, Simon Byrnand said:

...

I don't see how this would work.

Lets say I connect to xtra as my ISP, however I have a clear.net.nz email address and use xtra's smtp server to send my email. This sort of system would block it as being spam because it wouldn't be going through the correct poviders smtp server.

Which is one of the major sticking points of SPF. There are legitimate uses of "forging" domains like this...

At the risk of appearing stoopid, such as? If a domain lists all the IP addresses that mail from that domain could originate from, then presumably they're saying that greeting card sites and the like aren't going to be usable from this domain. Sounds like a good idea to me :-).

One good side would be that those who did list their domains with an SPF entry would be less likely to be the victim of a "joe job", provided that a large enough proportion of the recipients of such spam were checking SPF...

And that seems like a useful outcome in itself. It would also be a useful defence against the mindless joejobs that you see from the worm/virus de jour these days. Having watched the classic example yesterday where some random Bagle infected machine sent a mail to a list my SO runs, with From line forged so that it appeared to come from her. It had the right From line, so it got right through the "only allow posting from subscribers" check, and she's been getting harangued by noobs on the list ever since. SPF looks like it could stop that sort of nonsense happening. Cheers Si