OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Trust (was: SPF is fundamentally broken)

From: Alex van den Bogaerdt (alexergens.op.het.net)
Date: Thu Jan 15 2004 - 07:50:22 CST


On Thu, Jan 15, 2004 at 02:24:17PM +0100, Pierre Beyssac wrote:

> > No, C refuses mail because A does not allow B to impersonate A
> > and because C is setup to refuse, not tag.
>
> The net result is that:
> - C will lose legitimate mail because they use SPF ;

Wrong. C will loose impersonated mail because B does not know how
to resend mail without lying. Your definition of "legitimate mail"
is not my definition of it.

> or
> - A will cease publishing SPF records to stop SPF sites
> from blocking legitimate mail it doesn't want blocked ;

No, because A can choose to use "?all" if they desire to let
anyone use their RHS. If they don't desire that, there's no
reason _not_ to use SPF. They don't want you to use their RHS.
You are having a problem because you try anyway and C is not
allowing you to do so.

> or
> - A and C don't care a damn that mail is lost, and they
> continue using SPF.

If C doesn't care that _your_ mail is lost, then you'd be a
fool to forward to C. Especially if you _know_ they are rejecting
based on SPF. Even worse: If you are forwarding your mail in the
way you suggest, and if this is against C's policy, you are in
breach of their policy. Don't blame SPF for _your_ mistake.

Your current method is not allowed by both A and C, they've made that clear.

You are forgetting to mention the only proper solution.

        - C will accept messages from B, provided B is not lying
          through their teeth, and no mail is lost. Everybody
          is happy, except you who will have to figure out how
          to resend messages received by you to another place.

Alex
--
begin sig
http://www.googlism.com/index.htm?ism=alex+van+den+bogaerdt&type=1
This message was produced without any <iframe tags