Subject: Re: [Asrg] SPF, was where the message

From: Ian Eiloart <[email-masked]>
Date: Wed, 21 Jan 2009 11:06:59 +0000

>>> Don't hold your breath.  SPF is dead -- and good riddance, it was a very
>>> stupid idea --
>>
>> So dead that of hotmail.com, gmail.com, mac.com, apple.com,
>> microsoft.com,  facebook.com, ebay.com only er..., all of them publish
>> SPF records.
>
> For largely political reasons, Hotmail requires anyone sending a
> significant amount of mail to them to have Sender-ID records.
>
> For senders that are on its whitelist, AOL reverse engineers the IP
> addresses to whitelist from the sender's SPF records, which is way
> easier all around than the former mostly manual system.
>
> Since S-ID falls back to SPF records, most senders just publish one set of
> SPF records for both.  Note that neither of these are using SPF for its
> nominal purpose; I'm not aware of any large system that does.

They're using it for whitelisting purposes instead of its nominal purpose? 
That's exactly what I'm discussing. I think SPF has a bad reputation in 
some quarters because people think of how it breaks forwarding (etc). 
That's a shame, because it has huge potential when it comes to 
whitelisting, and therefore reducing false positives in filtering.

Heck, a career change isn't the same thing as death!

> R's,
> John
> _______________________________________________
> Asrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/asrg

-- 
Ian Eiloart
IT Services, University of Sussex
x3148
_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 22 Jan 2009 02:02:29 -0000

>That's exactly what I'm discussing.

Every once in a while, AOL fetches the SPF records for senders in
their whitelist, crunches them to get a set of IP addresses, and then
puts those IP addresses into their whitelist.  AOL's whitelisting
process is based on IPs, with the SPF bit merely being a cheap way for
senders to tell AOL what IPs they use.  They do not use SPF
per-message, nor as far as I can tell do they make any attempt to
match up the bounce address on incoming mail to the domain from which
they got the IP in the whitelist.

> I think SPF has a bad reputation in some quarters because people
> think of how it breaks forwarding (etc).

It could be somewhat useful for whitelisting some kinds of mail.  Too
bad it's been so egregiously oversold.

R's,
John

---

From: "John Glube" <[email-masked]>
Date: Wed, 21 Jan 2009 22:39:30 -0500

> purpose?

Up until the Spring of 2008, AOL was using SPF to
check what AOL called the "SPF_helo" and the
"SPF_822_from." 

We know this because the following headers were
observed in FBL data:

X-AOL-SCOLL-AUTHENTICATION: listenair ; SPF_helo: n

X-AOL-SCOLL-AUTHENTICATION: listenair ; SPF_822_from : n

("n" indicated the test failed. "y" indicated the
test passed.)

My understanding is that the "SPF_helo" check was
based on the perceived value of CSV and that the
"SPF_822 from" was part of the overall effort in
deciding whether to incorporate SID checks. It
was presumed that the data was also used as part
of the reputation analysis that AOL was running
on incoming mail.

I do not know whether AOL is still running these
checks. Investigation shows that AOL dropped the
X-AOL-Scoll-Authentication header sometime in the
summer of 2008.

My recollection from discussions with a former
AOL postmaster shortly after the collapse of
MARID is that AOL felt running an SPF_helo and
SPF_822_from check would be useful information as
part of the overall process of detecting and
blocking the "low hanging" spam.

John Glube

---

From: Ian Eiloart <[email-masked]>
Date: Fri, 23 Jan 2009 11:07:15 +0000

>>> Since S-ID falls back to SPF records, most senders just publish one set
>>> of SPF records for both.  Note that neither of these are using SPF for
>>> its nominal purpose; I'm not aware of any large system that does.
>>
>> They're using it for whitelisting purposes instead of its nominal
>> purpose?  That's exactly what I'm discussing.
>

Aren't the two things functionally equivalent? Oh, I guess that they're 
effectively whitelisting ALL email from IP addresses for which they trust 
ANY domain. I hope they've got some process that prevents them falling foul 
of the obvious attack.

> bad it's been so egregiously oversold.

Agreed. It's exactly why publication of SPF records (with ~all) should be 
encouraged. Once people get the hang of that, and using MSA, we'll be in a 
world where -all records will be less risky.