3 ms·
The Problems the article lists are correct still today. SPF should not be used to single-handedly decide whether to reject mail. The Alternatives the article l
by flurdy 8y ago
The Problems the article lists are correct still today. SPF should not be used to single-handedly decide whether to reject mail.
The Alternatives the article lists reflect the date (2005). Domain Keys and Cisco's alternative merged to become DKIM. DMARC came later.
Today I would suggest for most people to still use SPF but with ? or ~ (tilde), (Neutral or Softfail), and never - (Fail). So it becomes part of the spam scoring and not decider as there are too many false positives with SPF, as highlighted in the article.
Combine it with DKIM and at least initially a reporting only DMARC and you are on your way to a good set up.
SRS turned out to be a disaster. Idea good, implementation with spam bad.
- nasredin 8y agoI would suggest using the "-" ("reject") Life is too short to waste it on spam. If you can't set up proper SPF/DMARC/DKIM then I don't email me at all.
- flurdy 8y agoNo, that is the point, and mentioned in the article. "-"(Reject/Hard Fail) for SPF is broken and should be avoided. SPF only considers the sender and not the transport and recipient. It does not consider recipients' forwarding alias rules, backup MXs, multi relay domain setups, etc. I.e. normal email infrastructure and usage patterns. I have subset of users that uses Gmail as their client, SPF with "-" from a random valid sender would not allow me to redirect those emails to Google's servers. Also many aliases on my domains forwards to other addresses not on hosted by my servers (subsidiaries, personal accounts, mailing lists, etc), Spf with "-" will force the end SMTP server to block those emails as doubtful your SPF listing has listed my SMTP servers. And if a recipient domain has a more complex SMTP setup with mutiple SMTP servers acting as incomming, outgoing, bastions, backups, webmail, sharded storage, etc then any redirecting between them would again break with a strict SPF. As said before use: DKIM, DMARC but make sure SPF is set to not Fail as it is broken. Use Greylisting, Spamassassin etc to score spam to avoid false positives that are not obvious rubbish enough to reject on envelope details alone. Fastmail has a very good default recommendations: https://www.fastmail.com/help/technical/senderauthentication.html https://www.fastmail.com/help/technical/senderauthentication... My own Postfix doc's DKIM section: http://flurdy.com/docs/postfix/#ext_dkim http://flurdy.com/docs/postfix/#ext_dkim