fantomposter
Phantom Poster
Premium
join:2002-09-21
Independence, OH
| reply to TamaraB
Re: Why no revision to SMTP to include authenticat
said by TamaraB  :
Nope! SPF forces all mail from a domain to come ONLY from the allowed (SPF'd) domain's mail servers, which are advertised only by that domain's listed DNS servers. Spammer Fails!
Hopefully you are still here, I did not check this thread recently. been a busy weekend.
Spammer controls his domain. He can set up DNS and SPF any way he wants to point to any machine he wants.
So he lists the comcast trojaned machine as his domains mail server. And SPF fails. |
|
TamaraB
Question The Current Paradigm
Premium
join:2000-11-08
Brooklyn NYC
 ·Verizon Online DSL
| said by fantomposter :
Spammer controls his domain. He can set up DNS and SPF any way he wants to point to any machine he wants.
Any machine with an A record within his domain.
said by fantomposter :
So he lists the comcast trojaned machine as his domains mail server. And SPF fails.
He can't! He is not listed as authoritave for comcast IP's, he can use a redirect mechinism, but that does the oposite of what he wants.
My smtp server gets a connect from that trojened comcast machine, my server checks with COMCAST DNS for spf, not his DNS...
Think of SPF as an extension of MX. Only a list of a domains allowed "sending" servers instead of receiving servers (MX).
Spammer is toast!
--
Motor Vessel - Tamara B. - 43' Long-Range Trawler Cape Elizebeth ME.»www.tamara-b.org
|
|
fantomposter
Phantom Poster
Premium
join:2002-09-21
Independence, OH
| said by TamaraB :
He can't! He is not listed as authoritave for comcast IP's, he can use a redirect mechinism, but that does the oposite of what he wants.
I have not seen a spec on SPF that says you check IP addresses. It only checks the SPF records for the domain name in the from field.
quote:
My smtp server gets a connect from that trojened comcast machine, my server checks with COMCAST DNS for spf, not his DNS...
You got that backwards. That is not what SPF does. If I have that wrong point me to a website that explains it is otherwise.
All SPF does is check the authoritative DNS for the DOMAIN name in the from field. It checks the DNS records for that domain name and makes sure there is an SPF record that shows the sending computers IP address. If spammer controls his own domain name then he can put any IP address he wants in the SPF record.
Check here: »spf.pobox.com/faq.html
And scroll down to the part where the headline is:
"It doesn't really prevent spam. Spammers can always get throwaway domains, etc."
Don't get me wrong, SPF is needed, to fix the virus bounces and the forged from address's in spam, it does a great job of that, but not much more. |
|
