3 ms·
They should just use SPF. This is what SPF is designed for, and it allows them to keep the user experience simple and straightforward. No weird passphrase to en
by jey 16y ago
They should just use SPF. This is what SPF is designed for, and it allows them to keep the user experience simple and straightforward. No weird passphrase to enter into the email, no weird random email address to email to, etc.
- ComputerGuru 16y agoSPF only identifies the sending domain, not the sender himself. If your address is gmail and my address is gmail, our mx domain has the same spf record and same IPs. Sure, some mail servers will prevent you from authenticating with one ID and sending as another, but many others will let that slide.
- jey 16y agoYes, but that's a fault of the mailserver on that domain. It shouldn't allow spoofed email to be sent from its own domain.
- benatkin 16y agoSounds like a good partial solution to me. If SPF traces it back to a mail server that doesn't allow spoofed email, it could skip the confirmation step. GMail lets people change the from field, but only to an email address they can show they have access to, by clicking a confirmation link.
- ergo98 16y agoWhich others? Give some examples. Gmail won't. Hotmail won't. Yahoo won't. In fact I can't think of a single authenticating mail service that doesn't also validate authorization (e.g. you can only send as you). Now maybe you're going to point out micro-mail servers, but that's kind of beside the point because very few other people share it with you. e.g. you used gmail as your example, but services like gmail aren't vulnerable to that.
- petercooper 16y agoYeah, no passphrase, just a hard to explain set of weird looking DNS entries to confuse the heck out of non-technical people with. The point of having no passworwd is to make it simpler. You might as well go back to using a password instead of using SPF.
- rantfoil 16y agoWe do use SPF. It was related to the bug that caused this. It's been fixed now.