OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: SPF interoperability question

From: Jorey Bump (listjoreybump.com)
Date: Tue Jul 31 2007 - 15:06:10 CDT


M. Fioretti wrote:

> There is the fact that publishing SPF records is requirement #4
> of http://postmaster.msn.com/Guidelines.aspx

It is not listed as a requirement on that page, but "highly recommended".

> In other words, without going at all (please, please!!!!) into any
> variant of "MS s%&$cks!" it does _look_ that, on a strictly practical,
> day-to-day survival level, publishing an SPF record _is_ a thing to
> do.
>
> Unless, of course, one can really afford to say "probably we'll never
> be able to send email to any Hotmail user, hey who cares!" to himself
> and ALL the users of his email server. Is this correct?
>
> If yes, the most practical, yet tolerant solution is B), right?
>
>> B) Publish an explicit record

AFAIK, SPF was never intended to punish sites that choose not to publish
an SPF record. If an SPF record exists, a site is free to determine
local policy for handling mail from that domain (such as reducing the
spam score if it originates from an authorized server, and increasing
the spam score if it does not). Tolerance demands that an absent SPF
record is not weighted, since there is no industry or standards body
requirement that it exists. The same could be said about MX records.

Anyone suggesting that the absence of an SPF record will contribute to
or result in rejected mail must provide evidence. I think most would
agree that this would be an inappropriate use of SPF, regardless of
their opinion of its merits.