[Dovecot] spf record

[Rick Romero]

On Nov 28, 2007, at 12:08 PM, Udo Rader wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Rick Romero wrote:
>>
>> On Nov 28, 2007, at 11:26 AM, Dean Brooks wrote:
>>
>>> On Wed, Nov 28, 2007 at 11:06:40AM -0600, Matt wrote:
>>>>>> Your spf record is broken:
>>>>>>
>>>>>> dovecot.org.            39942   IN      TXT     "v=spf1 a -all"
>>>>>
>>>>> Care to tell also why? dovecot.org's mails are sent from the  
>>>>> same IP as
>>>>> its A record.
>>>>
>>>> Hmmm.  I would have listed mx as well but thats just me.  But just
>>>> listing a is likely better in that there are less lookups for the
>>>> receiving system.
>>>>
>>>> One thing that bugs me is why we must now implement domainkeys  
>>>> on top
>>>> of SPF.  SPF pretty much does everything domainkeys does but  
>>>> simpler.
>>>
>>> Because SPF is a broken hack that doesn't properly accomodate the
>>> forwarding of email without the use of other complicating hacks
>>> such as SRS which mangle the sender address.
>>>
>>> SPF should have been scrapped years ago.  Instead, most large
>>> organizations use "?all" in their SPF entry (typically because of  
>>> the
>>> forwarding problem), putting SPF in advisory mode which negates the
>>> whole purpose of having it anyway.
>>
>> I disagree.
>> The only way you should be using SPF on the receiving end is as an
>> additional weight for spam scoring.
>
> Some time ago there was a similar discussion on the postfix ML and  
> I had
> pretty much the same arguments that you had.
>
> But as a matter of fact, I got corrected. The major problem with even
> scoring is that the only things spammers have to do (and they  
> really do
> it!) is to register some new domain, enter valid SPF records for it  
> and
> then their scoring might even improve.

I only give negative points for non-matching records.  No positive  
points.  (Unless I misconfigured something, that's how I believe -  
and want - it to work).
The idea being that even if the record doesn't match, if it's a valid  
email you won't have enough other negatively scoring components to  
completely drop it.

If there is a negative match on spam then we're also compensating for  
changes in the structure of the email that might get it past bayesian  
filters.

If there is no record, or a positive match, then IMHO we're really  
neither better nor worse off.

The 'spammers create domains' argument almost negates the sender  
verification system entirely - assuming you're giving positive points  
for any valid records.

Rick

> - --
> Udo Rader
> http://www.bestsolution.at
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Mandriva - http://enigmail.mozdev.org
>
> iD8DBQFHTa6BuhFd84GLxP8RAh2uAJ43FN6z1DZkEP6Uun0CxnuA+iSukQCfcqiY
> bSBpLiK6MmDvahOLmYt0lTc=
> =zmqd
> -----END PGP SIGNATURE-----