Subject: Re: [spfbis] [dmarc-ietf] Should we encourage the use of SPF "soft include" for common platforms?

From: Brandon Long <[email-masked]>
Date: Fri, 8 Mar 2019 16:36:49 -0800

On Sat, Feb 23, 2019 at 11:35 AM Vladimir Dubrovin <dubrovin=
[email-masked]> wrote:

>
> It's bad idea, because "?" does not grant SPF authentication. SPF is
> important even if message is DKIM signed and regardless of DMARC, because
> it authenticates envelope address. As an example, NDR/MDN  may not be
> generated to envelope address which is not SPF authenticated, we actually
> use this rule in practice to eliminate secondary spam.
>
> GSuite, O365 and large ESPs should not allow to use unvalidated/spoofed
> e-mail address. If somebody allows to spoof sender, there is also a good
> chance it DKIM signs spoofed message, because DKIM signature is applied by
> the same party.
>

Although we go through great pains not to allow you to generate new
messages with spoofed addresses, and we also are very particular about what
we will DKIM sign... we haven't been as particular with SPF.  I kept
meaning to create a new smtp-out IP pool that wasn't in our SPF record, but
given our SPF record was "all our IPs", that was never an easy task.  We
then could have used that pool for any message where we don't want to
potentially validate with SPF.

As to why we have any messages like that, its because of forwarding and
relaying.  And the cases where you should use your non-SPF IPs include
"same domain", ie if you get a spoofed message to a mailing list on the
domain, it shouldn't acquire SPF auth by virtue of going through the list.

The solution we've used for that now is ARC, we'll "remove" the spf auth of
a message if it has an spf=fail for the same domain in the ARC chain.

Brandon

>
> 23.02.2019 21:07, Kurt Andersen (b) пишет:
>
> With the growth of huge platforms that emit mail from the same common set
> of IPs (such as GSuite, O365, or large ESPs), regular SPF "include" ends up
> granting a DMARC pass to a lot more potential authors than most
> organizations would necessarily choose to grant.
>
> Instead of using the standard "(+)include:" approach, if domain owners
> used "?include:" as their mechanism, then that would prevent the SPF result
> from granting a DMARC PASS result when traffic is coming from one of these
> massively included platforms. It would essentially force the DMARC result
> to be driven only by the DKIM evaluation.
>
> Thoughts?
>
> --Kurt Andersen
>
> (I'm copying the spfbis list too because there may be folks lurking there
> who are not on the DMARC list)
>
> _______________________________________________
> dmarc mailing [email-masked]://www.ietf.org/mailman/listinfo/dmarc
>
>
> --
> Vladimir Dubrovin
> @Mail.Ru
>
> _______________________________________________
> spfbis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spfbis
>