[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Asrg] Re: SPF abused by spammers



On 2004-09-14 17:03:04 -0400, Barry Shein wrote:
> I will admit that I am *almost* beaten into the ground in pure
> frustration by the lengthy verbiage and misinterpretations of the
> questions but ONE MORE TIME...(I know I know it's all my fault.)
> 
> Can wanadoo.fr publish an SPF record allowing the PC which is
> currently assigned the host name:
> 
>       ABordeaux-251-2-10-162.w82-125.abo.wanadoo.fr
> 
> to send mail claiming to be from:
> 
>       johndoe at ABordeaux-251-2-10-162.w82-125.abo.wanadoo.fr
> 
> I say they can

Of course they can. 

> and likely will,

Why should they? No legitimate user would want to send mail as
johndoe at ABordeaux-251-2-10-162.w82-125.abo.wanadoo.fr, because he will
never be able receive an answer (assuming that this is an address in a
dynamic address pool). The legitimate user will send want to send mail
as johndoe at wanadoo.fr, or maybe johndoe at bordeaux.wanadoo.fr.

Publishing such records makes no sense at all. Publishing records
allowing the whole dial-in pool to send mail as johndoe at wanadoo.fr makes
at least some sense and some providers may do that.

Anyway, if wanadoo chooses to publish such records, who cares? Does it
make any difference whether the spam comes from
<johndoe at ABordeaux-251-2-10-162.w82-125.abo.wanadoo.fr> or from
<johndoe at nigerianlottoviagra5731ab.biz>?

> but more importantly that spammers who
> grab such a host as a zombie can use this to send all the mail they
> want past any SPF.

SPF doesn't stop spam. It doesn't even try to stop spam. All it does is
tell the recipient whether a certain IP address is allowed to send mail
on behalf of a certain domain.

This allows to domain owner to prevent forgeries (or rather, allows the
domain owner to publish information which will allow the recipient to
recognize the forgery easily), which will reduce bounces and misguided
complaints.

It may be used against spam together with a reputation system for
domains. But frankly, I don't see why a reputation system for domains
should be more effective than the existing reputation systems for IP
addresses (aka RBLs).

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | hjp at hjp.at         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd

Attachment: pgpxb9VmxZBlA.pgp
Description: PGP signature

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg