Subject: RE: SPF abused by spammers

From: "Sauer, Damon" <[email-masked]>
Date: Thu, 9 Sep 2004 10:07:21 -0500

Dean,

 You are missing where this is a GOOD thing. We WANT spammers to use
SPF.
This will allow us to identify, publish, process, shred, pillage, burn,
destroy the IP addresses that this stuff is coming from. Nobody is doing
less stringent processing of the email that passes an SPF check. It just
makes it easier to block when identified.
 The checks that I DON'T have to do are against the received from:
headers. I already know. If you want to call this 'reducing filtering'
so be it. But it is a reduction because the check that you used to have
to run is no longer necessary.

Regards,
Damon Sauer

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Dean Anderson
Sent: Thursday, September 09, 2004 10:59 AM
To: Markus Stumpf
Cc: [email-masked]
Subject: Re: SPF abused by spammers

Isn't that what I said would happen?

		--Dean

On Thu, 9 Sep 2004, Markus Stumpf wrote:

> 
> Justin Murdock posted this link on the qmail list:
>     http://news.bbc.co.uk/1/hi/technology/3631350.stm
>     "CipherTrust [...] found that 34% more spam is passing SPF checks
than
>     legitimate e-mail."
> 	\Maex

Date: Tue, 10 Aug 2004 19:55:57 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: 'IETF MARID WG' <[email-masked]>
Subject: Analysis of SPF benefits for reduced filtering

It has been reported that AOL is already using SPF to give reduced 
filtering to SPF-using domains. Is this a good idea?

IF you use SPF to provide less stringent anti-spam processing, then you
are MORE vulnerable than you were before. You have shot yourself in the
foot.  Suppose for example that AOL subjects MSN users to less stringent
anti-spam filtering because MSN uses SPF.  MSN is still vulnerable to
viruses as it was before it used SPF, and it is just as vulnerable to
disposable account creation as it was before.  Using SPF will
__attract__ abusers to MSN, because they can get more spam through to
AOL, because it is subject to less processing.  Since AOL is doing less
processing on the same spam, AOL users get more spam. SPF is bad for
both companies.

And of course, anyone who sets up a disposable domain can also get spam
through to AOL by creating an SPF record for the domain. Disposable
domains along with disposable or stolen accounts is a major problem now,
and it remains a major problem under SPF.

Anything that reduces spam filtering without reducing the number of
abusers will be harmful.

Basically, SPF gives abusers the opportunity to whitelist themselves, or
the opportunity to identify ISPs that may be whitelisted. Any kind of
whitelist that is under the control of the sender, rather than the
recipient is also going to be ineffective and harmful.

Dean Anderson
Av8 Internet, Inc

*****
The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material.  Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited.  If you received this in error, please contact the sender and delete the material from all computers. 113

---

From: Douglas Otis <[email-masked]>
Date: Thu, 09 Sep 2004 12:31:20 -0700

On Thu, 2004-09-09 at 08:07, Sauer, Damon wrote:
> SPF. This will allow us to identify, publish, process, shred, pillage, burn,

How do you know the spammer has not bothered to include addresses of 
legitimate MTAs?  The obvious adaptive strategy would be to disrupt this
presumptive use of spammer's information as-if it were trustworthy.  

> to run is no longer necessary.

The value of SPF is clear when white-listing as a means for reducing
false negative assessments.

SPF will never serve as a tool for blacklisting for what should be
obvious reasons.  There is a risk presuming the domain identified using
SPF has not been spoofed somewhere in the mail channel.  SPF does not
allow the IP address to be trusted to allow address blacklisting beyond
the current connection, nor does SPF really allow the MAIL FROM mailbox
domain be trusted to a degree that would allow name blacklisting, as it
fails to accurately identify the entity introducing the message.  The
mail channel is often shared and there is no means to verify the channel
is being checked at either end of the administrative realms.

-Doug

---

From: Dean Anderson <[email-masked]>
Date: Thu, 9 Sep 2004 18:59:46 -0400 (EDT)

> makes it easier to block when identified.

SPF doesn't make it easier to identify spammers.

---

From: Dean Anderson <[email-masked]>
Date: Thu, 9 Sep 2004 19:14:11 -0400 (EDT)

> presumptive use of spammer's information as-if it were trustworthy.  

Yep. Suppose you have a piece of spam. You look at the from address. Can
you check the SPF record for that domain? No. Its probably changed between
the time the message was sent and the time you looked at it. You can check
the original IP address that your MTA logged in the received header.  But
YOU COULD DO THAT BEFORE.  I don't think I'm the only one thinking "duh!"
just about now.

You might as well go back to domain name blocking. But YOU COULD DO THAT
BEFORE, too. (another big "duh!". We don't do that because spammers send
from big ISPs that we can't block, or use viruses to steal resources from
innocent domains. Or use disposable accounts.

		--Dean

> false negative assessments.

There is already a two line rule for sendmail and other MTAs to do IP 
based whitelisting, and great software, called rbldns.  I don't see a 
benefit in replacing something that works with something that offers 
benefits to spammers and abusers.

> is being checked at either end of the administrative realms.

What he said.