16 ms·
Why you shouldn't jump on the SPF bandwagon (2005)
- zlynx 8y agoI've been using SPF in my SpamAssassin rules for over 10 years now and it has only ever been a good thing. score SPF_FAIL 0 0.919 0 0.919
- n3storm 8y agoThat is not exactly how SPF was meant to use. If it fails email should be rejected not scored. Disclaimer: I do the same as you.
- nailer 8y agoSo the developer of SPF (see jedberg above) says it should be used as a ranking factor, but SPF itself says it should be rejected? Maybe the issue with SPF is in the messaging around it?
- LambdaComplex 8y agoI think that would depend on whether the SPF record indicated soft-fail or hard-fail, no?
- mehrdadn 8y agoWeirdly enough, I've had this problem with DMARC, not SPF. It occurs on a very small fraction of emails from more "sensitive" domains, like a fraction of emails from one or two banks. In particular, Gmail completely silently drops emails forwarded by hosts that aren't explicitly authorized by the sender's DMARC policy, which sucks because it means I can't forward such emails from my _own_ addresses on other domains to my _own_ Gmail account. I understand this is because the sender's DMARC policy says that the receiver should hard-reject any mail delivered by unauthorized middlemen, which seems naively short-sighted given that anyone can deliver email, and DKIM already lets the receiver verify the authenticity. (Is this even compliant behavior?) Does anyone have a reasonable workaround for forwarding to Gmail in such cases?
- nothrabannosir 8y agoI’m afraid I don’t. This was in fact why I stopped hosting a mail server for friends, way back when. I realised that if most of them put their gmail address in ~/.forward, any spam they received on their account on my domain, gmail would count towards my domain / ip instead of the original sender. This is a fundamental flaw with current email implementations; there is no equivalent to something like the “trusted downstream proxies” list.[1] I always wondered why gmail wouldn’t have a (per account) setting to say: “I am forwarding mail from this host / domain / address”, with corresponding trust of Received: headers chain. If I could then add a header in forwarded mails requiring that to be set, somehow, then we could avoid this SPF / DMARC problem entirely. The fundamentals are there (received: headers and DKIM). All we need is some last mile config :( But it would promote decentralisation, so I’m not holding my breath. [1] random search result of such an implementation: https://github.com/tornadoweb/tornado/pull/1864/files https://github.com/tornadoweb/tornado/pull/1864/files
- cm2187 8y agoBut why doing email forwarding. If it is a custom domain, why not simply use gmail as your MX entries?
- jacobush 8y agoMaybe some aliases are forwarded or whatever. I could see myself doing it if I didn't get the warning above. (Thanks!) In fact, I was possibly about to next month as a way to easily relay from an about to be disused address to a new address at gmail (or whatever my "friend" chooses to migrate to.)
- mehrdadn 8y agoConfused, how does that work? How would Gmail know which mailbox to put an email it gets for an address in a different domain?
- cm2187 8y agoGmail like pretty much every other providers offers to manage custom domains. You point your mx entries to them, you setup the mailbox and aliases on the google side, and you have a emails in yourdomain.com running using gmail behind the scene. Just google "gmail custom domain".
- INTPenis 8y agoI manage some pretty big spam filters for national regions and hospitals and we need SPF to ward off potential phishing attacks claiming to be from our own domain. At the same time I do agree with the author that SPF might be harmful for the rest of the internet by vouching for e-mail from a certain sender but if you're relying solely on SPF then you've misconfigured.
- janci 8y agoIt's SRS that is broken, not SPF.
- jedberg 8y agoI helped develop SPF, and created what may still be the "largest" SPF record (eBay.com and PayPal.com). That being said, the author is mostly right. You shouldn't reject email that fails SPF. BUT, there is a use for SPF. You add it as a factor in your spam filter. Deduct points for an SPF failure, or make it an aspect among many in your filters. It's still a useful way for one org to tell another org, "here are the IPs you should expect mail to come from".
- flurdy 8y agoThe Problems the article lists are correct still today. SPF should not be used to single-handedly decide whether to reject mail. The Alternatives the article lists reflect the date (2005). Domain Keys and Cisco's alternative merged to become DKIM. DMARC came later. Today I would suggest for most people to still use SPF but with ? or ~ (tilde), (Neutral or Softfail), and never - (Fail). So it becomes part of the spam scoring and not decider as there are too many false positives with SPF, as highlighted in the article. Combine it with DKIM and at least initially a reporting only DMARC and you are on your way to a good set up. SRS turned out to be a disaster. Idea good, implementation with spam bad.
- nasredin 8y agoI would suggest using the "-" ("reject") Life is too short to waste it on spam. If you can't set up proper SPF/DMARC/DKIM then I don't email me at all.
- flurdy 8y agoNo, that is the point, and mentioned in the article. "-"(Reject/Hard Fail) for SPF is broken and should be avoided. SPF only considers the sender and not the transport and recipient. It does not consider recipients' forwarding alias rules, backup MXs, multi relay domain setups, etc. I.e. normal email infrastructure and usage patterns. I have subset of users that uses Gmail as their client, SPF with "-" from a random valid sender would not allow me to redirect those emails to Google's servers. Also many aliases on my domains forwards to other addresses not on hosted by my servers (subsidiaries, personal accounts, mailing lists, etc), Spf with "-" will force the end SMTP server to block those emails as doubtful your SPF listing has listed my SMTP servers. And if a recipient domain has a more complex SMTP setup with mutiple SMTP servers acting as incomming, outgoing, bastions, backups, webmail, sharded storage, etc then any redirecting between them would again break with a strict SPF. As said before use: DKIM, DMARC but make sure SPF is set to not Fail as it is broken. Use Greylisting, Spamassassin etc to score spam to avoid false positives that are not obvious rubbish enough to reject on envelope details alone. Fastmail has a very good default recommendations: https://www.fastmail.com/help/technical/senderauthentication.html https://www.fastmail.com/help/technical/senderauthentication... My own Postfix doc's DKIM section: http://flurdy.com/docs/postfix/#ext_dkim http://flurdy.com/docs/postfix/#ext_dkim
- livebsd 8y agoI've been managing my own mail server since forwever (when nanae was still a thing: news.admin.net-abuse.email). SPF is not too bad as far as forging countermeasures work. It's relatively simple both to implement and to check. I'm not against it. What I don't like is every single other standard they pushed later. I personally think DMARC is borderline useless. DKIM is plainly horrid and breaks just about everything you'd expect from email such as mailing lists, while not solving anything both from a legitimacy perspective and from a spam perspective. Like everybody says, the "recommended" solution is to pour each and every of these half-assed solutions into a score system. Which sucks, because when a legitimate email is rejected, the fix is never trivial: it could be just a perfectly legitimate host which decided that all these solutions are crap (and they're right). You know my current 90+% spam and scamming source by volume? It's gmail.com. It's passing all these checks, of course. It's the reason I consider DKIM virtually useless even from a legitimacy perspective: a valid DKIM signature from any large/free email provider bears no significance to the point that even if I had a decent UI for validation in my email client, I would basically have to avoid it: "oh, right, another legit scam from gmail.com".
- lolc 8y agoMaybe consider that gmail.com is such a big source of spam exactly because the other routes are being warded off.
- marcosdumay 8y agoWhy is that relevant? All the barriers are just increasing the power of gmail, making it impossible to filter it off. It's mostly likely that the volume of spam will remain constant, whatever we do. But the current fight (led by Google, for some reason) is just breaking the email federation. By the way, now that we have all the natural language tools, what was made of content based filtering?
- lolc 8y agoIt's relevant because spammers wouldn't go to the trouble of dealing with Gmail if they had easier venues. And I disagree that the volume of spam is constant. Also content-based filtering is already huge. The threat to the federation model is clear though.
- oelmekki 8y agoJust to be clear, if we don't implement SPF on our domain names, our mails will be rejected by gmail, right? If that's so, this is purely a theoretical discussion (which has its own merits, of course).
- ceejayoz 8y agoI don't believe Gmail rejects automatically for missing SPF records. It may be a significant hit to the spam score, but it's still technically optional.
- oelmekki 8y agoI see, thanks. I had the experience of having some mails ending in gmail spam box until we added SPF, but we were a young company (and thus, domain name), and it was in 2014. I wouldn't feel confident recommending not using SPF to anyone, though :)
- wolrah 8y agoCorrect. I can say for sure that Gmail does not reject for missing SPF records, I send voicemail-to-email messages from VoIP systems with no DNS records all the time. Gmail will accept anything that isn't actively failing anything, even spoofed nonexistant domains, but it will likely get flagged as spam. If the host is the (or one of the) A/AAAA records for the From domain it'll generally not flag as spam. If the host is not, then SPF records are required to be reasonably confident it won't get flagged. Office 365 is a bit pickier and Yahoo is a pain in the butt. Fortunately I deal with mostly business systems so telling the end user "stop using Yahoo for your company voicemails" is reasonable.
- CodeWriter23 8y agoMy experience is anything less than SPF, DKIM and DMARC results in Gmail silently dropping messages. Also, HTML mail with inline images similarly causes Gmail to drop. And forget about sending from a DO Droplet due to poor IP reputation. A friend of mine at an ISP confirmed their third party SPAM scoring provider (like Symantec/ Brightworks) gives them a list of IPs to block at the edge, which includes large swaths of DO’s IP blocks. Not sure what the story is for other low-end VPS providers like Linode, etc. Testing deliverability has become completely absurd. Every ISP and ESP has a completely different method for mail rejection. And thanks to outsourcing options for SPAM scoring, is subject to change at a moment’s notice. This is a glaring omission in all Net Neutrality discussions I’ve seen, the ability to simply communicate an order acknowledgement to a customer. Even outsourcing to Mailgun, SendGrid or the like is no silver bullet for this issue, you’ll still have interruptions in delivery because every day some spammer gets through their checks and trashes that shared IP you’re sending from. And probably you’re having unnoticed delivery failures because someone else reported it / got it fixed. Renting a dedicated IP isn’t really a solution because you have to send from IPv4 to reach the guy who is still doing email @hisdomain.com and doesn’t even know IPv6 is a thing. And IPv4 addresses are in short supply.
- RobertRoberts 8y agoWithout SPF records, automated email notices from my sites to any system like Gmail, Hotmail, Office, Yahoo, etc... were rejected. I don't care if it doesn't work, if 90% of every day emails are getting rejected without SPF, then I setup SPF. Edit: For serious email delivery these days DKIM is required...
- badrabbit 8y agoThis is a ridiculous article. First off,most orgs have an outbound mail provider that supports spf. Second, Spf can be setup to softfail (mail gets delivered anyways). I have used spf many times to distinguish forged phishing email vs phishing email originating from a compromised account. SPF is like most security solutions,its purpose is to reduce risk not eliminate it. If you really want to go down the rabbit hole of eliminating risk,your first step should be to not use email at all.