Subject: SPF testing can be done against other addresses (Was: DEPLOY: Legal liability for creating bounces from forged messages

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 3 Sep 2004 12:24:17 +0200

On Thu, Aug 26, 2004 at 01:19:37PM -0700,
 Jim Lyon <[email-masked]> wrote 
 a message of 17 lines which said:

> > Is it unrealistic to assume that, if the current Sender-ID becomes a
> > RFC as it is, nevertheless, some people will use SPF records (as
> > specified in -protocol) to perform checks on the 2821 MAIL FROM and
> > not only on the official PRA?  A sort of unofficial "Unified SPF"?
> 
> Yes, it's realistic to assume that some software will do this.  The
> technical term for such a program is "broken".  :-)

I disagree. Sender-ID currently mandates a test against the PRA but,
as the modular architecture of the Sender-ID documents demonstrate,
you can test SPF records against many things. This will not be
Sender-ID, but it does not mean it is broken.
 
IMHO, this would be a sensible course of action to work around the
patent problem.

> The whole point of having a standard is so that senders know what
> the expectations are for the mail they send, and that receivers know
> what they should be looking for.

At the present time, it is far from true. Bulk emailers typically
complain that they never know in advance what sort of checks will be
performed against their messages.

ISPs typically implement and deploy hastily a lot of ill-advised tests
(like testing that the client MTA has a PTR) without taking into
account standards, best practices or even other opinions.

Given the architecture of the Internet, it will probably never change.

> The whole PRA stuff was invented 

I'm glad that you do not say who invented it :-)