4 ms·

Does Postereous not support SPF? SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really

by ergo98 16y ago

Does Postereous not support SPF? SPF tells you that the email really came from my server. That the email really came from my server tells you that it's really me, as sending through my server requires a password. Sadly SPF is grossly underused.

ergo98 16y ago
As an aside, instead of post@, posterous should use a guid for each blog. e.g. B566EA61026F474BA8ADB877FF765087@postereous.com If you're on another device just email whoami@postereous.com and it responds with with your GUID post address. Of course email is hardly confidential, and it would be sent in the clear, but it's a heck of a lot more powerful than simply looking at a from address.
- deleted 16y ago
  [deleted]
  - lyso 16y ago
    No, since the reply goes back to the real address.
  - drdew 16y ago
    How embarrassing for you. How exactly would the email go to the forger if they are spoofing YOUR email address. Coffee in the morning, gin at night. Never switch the two.
    - mcav 16y ago
      People can't always be right, eh? I was mistaken. You're right, I haven't had my coffee yet.
    - benatkin 16y ago
      I like that better than "What are you smoking?" Still overly rude, though.
eli 16y ago
Sure, they could check SPF, but what if your mail server doesn't support it? Reject the message?
- ergo98 16y ago
  If SPF isn't configured on the domain then it should simply go without that safeguard (maybe forcing confirmations?). SPF is, however, a pretty good indicator that the email is legitimate.
  - fizzfur 16y ago
    Yeah, as soon as I saw this post I thought of SPF and DomainKeys. Seems simple: If your mail/DNS is setup to support either of these, then cool you don't need to confirm. Else, you must "ok" each post. DONE
petercooper 16y ago
Since part of the allure was the need for "no passwords" in order to be simple, I doubt explaining SPF to novices is going to be a step forward.
qjz 16y ago
SPF doesn't verify the sender, it only tells you if the server is allowed to send mail from a domain. You can still use the password for your account to forge the sending address of another user in the domain. Besides, the fact that your domain requires a password is only meaningful to you; it has no value to the outside world in terms of identity assurance.
- ergo98 16y ago
  >You can still use the password for your account to forge the sending address of another user in the domain. Very few mail servers allow you to that. Once you add sender authentication, it generally comes with sender authorization. >Besides, the fact that your domain requires a password is only meaningful to you Almost all SMTP servers are locked down now, most requiring authentication. Those that aren't get blacklisted pretty quickly. SPF tells you that the sender is authorized to send on behalf of that person. It solves 99.9% of the issue.

by ergo98 16y ago

ergo98 16y ago

As an aside, instead of post@, posterous should use a guid for each blog. e.g. B566EA61026F474BA8ADB877FF765087@postereous.com If you're on another device just email whoami@postereous.com and it responds with with your GUID post address. Of course email is hardly confidential, and it would be sent in the clear, but it's a heck of a lot more powerful than simply looking at a from address.

deleted 16y ago
[deleted]
- lyso 16y ago
  No, since the reply goes back to the real address.
- drdew 16y ago
  How embarrassing for you. How exactly would the email go to the forger if they are spoofing YOUR email address. Coffee in the morning, gin at night. Never switch the two.
  - mcav 16y ago
    People can't always be right, eh? I was mistaken. You're right, I haven't had my coffee yet.
  - benatkin 16y ago
    I like that better than "What are you smoking?" Still overly rude, though.

eli 16y ago

Sure, they could check SPF, but what if your mail server doesn't support it? Reject the message?

ergo98 16y ago
If SPF isn't configured on the domain then it should simply go without that safeguard (maybe forcing confirmations?). SPF is, however, a pretty good indicator that the email is legitimate.
- fizzfur 16y ago
  Yeah, as soon as I saw this post I thought of SPF and DomainKeys. Seems simple: If your mail/DNS is setup to support either of these, then cool you don't need to confirm. Else, you must "ok" each post. DONE

petercooper 16y ago

Since part of the allure was the need for "no passwords" in order to be simple, I doubt explaining SPF to novices is going to be a step forward.

qjz 16y ago

SPF doesn't verify the sender, it only tells you if the server is allowed to send mail from a domain. You can still use the password for your account to forge the sending address of another user in the domain. Besides, the fact that your domain requires a password is only meaningful to you; it has no value to the outside world in terms of identity assurance.

ergo98 16y ago
>You can still use the password for your account to forge the sending address of another user in the domain. Very few mail servers allow you to that. Once you add sender authentication, it generally comes with sender authorization. >Besides, the fact that your domain requires a password is only meaningful to you Almost all SMTP servers are locked down now, most requiring authentication. Those that aren't get blacklisted pretty quickly. SPF tells you that the sender is authorized to send on behalf of that person. It solves 99.9% of the issue.