OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: how to set up proper forwarder

From: Alexey Koptsevich (kopts+asg654haboob.atmosp.physics.utoronto.ca)
Date: Fri Jan 06 2006 - 16:52:35 CST

>> >> If my user forwards his mail somewhere and it happens that
>> >> a) somebody sends him a message from the domain with SPF record,
>> >> b) the final destination filters mail based on SPF,
>> >> then it might be that mail for _my_ user will be dropped.
>> >> My question was not whether SPF is right or wrong, but how
>> >> can I set up things that mail will be reliably delivered
>> >> without controlling where my users forward mail and explaining
>> >> tem what is SPF and how it works.
>> >
>> > This is not your problem. The receiving site and SPF publishing site
>> > have elected to not support mail forwarding. The user who wants his
>> mail
>>
>> What do you mean by "site"? There are two completely separate entities
>> here -- site admins/owners and site users. The first one indeed elected
>> to do something, but I am talking about the second one.
>>
>> > forward should switch to a provider that does not reject mail based on
>> > SPF records.
>>
>> It is easy to switch between free email providers, but if your email
>> provider is your employer? Most people do not have much control over
>> their employers.
>
> Well then that employer is saying "we don't accept forwarded email" by
> virtue of the fact that they are using SPF. So the users/emplotess
> should just arraange to have their email sent directly to them.

Well, then users should know what is SPF and that their provider indeed
uses it and that it does not work with forwarding etc etc etc etc
Enlightening mail admins may be a solution, but enlightening users
is definitely not.

I think the solution could be to forward via procmail using
recipe from http://www.openspf.org/faq.html#forwarding
If bounce occurs, its attachments should be scanned for the
presence of this header and the bounce should be redirected to the
original sender extracted from this attachment.

Two questions here:

1) Is it a requirement that the original message is always attached
to the bounce message, or I cannot count on it?

2) Are there drawbacks in this approach?

Thanks,
Alex