Re: Spammers Skirt IP Authentication Attempts

[Paul Vixie <paul () vix com>]

> True, but bounces, and anything else with NULL return path, can be taken
> care of with SRS.

SRS is probably a higher pairwise deployment barrier than SPF.  but in any
case you should take this argument to the IETF MARID WG, since getting
agreement on nanog@ (assuming it's possible) won't stop the SPF steamroller.

> See:
>
>       http://www.libsrs2.org/
>       http://www.libsrs2.org/srs/srs.pdf
>       http://asarian-host.net/srs/sendmailsrs.htm
>
> And be happy, and realise "SPF is worthless" ;)

SRS looks like a better technical solution than SPF, but it's less deployable.
for one thing, There Can Be Only One SRS-like thing.  there are already many
SPF-like things, each with its own adherent-base, and there will be many more.

> Is it really worth it for every domain owner on the planet (including
> spammers!) to implement SPF records in DNS, and the resulting forwarding
> breakage, simply to provide some fairly intangible "dilution protection"
> for, primarily, the very small subset of widely-known domains out there?

no.  it's the same kind of cost/benefit assymetry as spam, where everybody
has to pay a higher cost but only a few get a significant benefit from it.

however, beta was better than vhs, too.  and tully's is way Way better than
starbucks.  being better isn't as relevant as having better marketing.  with
microsoft backing SPF++ (is it "sender-id" now?), SPF will be widely deployed
and the costs and benefits be damned.

> > ...  i'm glad that companies bigger and richer than i am find it in
> > their own selfish best interests to push something like SPF -- that
> > means it'll happen.  ...
>
> Well that depends. At the moment it looks like the clients will
> implement a standard that most of the servers will not!

i've begun to hear privacy related concerns, as well.  even with jim miller's
MAIL-FROM proposal, there's a way to look at the DNS query stream and find
out what servers are presently being spammed using your domain name as the
source.  this is an information leak but i'm willing to live with it.  many
MTA operators will not be willing to live with this.  (maybe some large ones.)

> > it's useful, just not for the advertised reasons, or a universal reason.
>
> Ah, absolutely yes.

so, i'll take your "SPF is worthless!" statement under advisement.