keyboard5684
join:2001-08-01
Youngsville, PA
 ·Teliax VOIP
 ·WestPAnet Inc.
 ·WestPAnet Inc. CA..
| Re: Why no revision to SMTP to include authenticat The problem is not authenticating clients that use SMTP, the problem is authenticating email servers. For example, a client sending mail can authenticate with there ISP's mail server to send mail but how do we authenticate that ISP's mail server when it send to the remote domain.
We could not possibly make up logins for every single mail server in the world so they all could communicate.
SPF addresses this in a good way. This way the domain provider themselves says what specific mail servers are allowed to send email with that from address. | |
|
 fantomposter
Phantom Poster
Premium
join:2002-09-21
Independence, OH
| Re: Why no revision to SMTP to include authenticat said by keyboard5684  :
The problem is not authenticating clients that use SMTP, the problem is authenticating email servers.
Exactly. And SPF does not stop spam, it stops forged from addresses. Nothing more. | |
|
 | Megladon13
join:2003-09-05
Minneapolis, MN | Re: Why no revision to SMTP to include authenticat ...and right now thats about 99% of the spam we are all getting. | |
|
ParanoiaInc
join:2002-08-28
Tucker, GA | I would think that by only allowing subscribers to send out email through the ISP's authenticating-email servers (block port 25), and disallowing subscriber-centered email servers, this could help address the problem. | |
|
| 
jjoshua
Premium
join:2001-06-01
Scotch Plains, NJ | Re: Why no revision to SMTP to include authenticat This would mostly be an inconvenience for people who don't send SPAM. A lot of people use 3rd party email services because we don't want to use the one provided by our ISP for various reasons. | |
|
| | 
coward
@pacbell.n | Re: Why no revision to SMTP to include authenticat tough - i'm sick of spam, and i'm even more sick about spam from bogus email addresses. true, some jerks have ruined it for the rest of us, but we all learned to deal with things like that when we were 6 years old.. | |
|
| | |
| fantomposter
Phantom Poster
Premium
join:2002-09-21
Independence, OH
1 edit |
Spammer sets up his throw away domain. Puts up DNS for it at a place where it can be changed easily and quickly.
He finds a trojaned Comcast machine to use. He changes his DNS file to show the proper SPF record for that Comcast machines IP addy.
Then he fires his spamm off from that machine and SPF stops nothing because he controls the domain and the SPF records.
Rinse-Lather-Repeat. SPF only stops someone from using my or your address as a forged from, and it stops the virus that use forged froms.
It will not stop spam nor will it slow it down much. | |
|
| | |
| | | fantomposter
Phantom Poster
Premium
join:2002-09-21
Independence, OH
| Re: Why no revision to SMTP to include authenticat said by TamaraB :
Nope! SPF forces all mail from a domain to come ONLY from the allowed (SPF'd) domain's mail servers, which are advertised only by that domain's listed DNS servers. Spammer Fails!
Hopefully you are still here, I did not check this thread recently. been a busy weekend.
Spammer controls his domain. He can set up DNS and SPF any way he wants to point to any machine he wants.
So he lists the comcast trojaned machine as his domains mail server. And SPF fails. | |
|
| | | | |
| | | | | fantomposter
Phantom Poster
Premium
join:2002-09-21
Independence, OH
| Re: Why no revision to SMTP to include authenticat said by TamaraB :
He can't! He is not listed as authoritave for comcast IP's, he can use a redirect mechinism, but that does the oposite of what he wants.
I have not seen a spec on SPF that says you check IP addresses. It only checks the SPF records for the domain name in the from field.
quote:
My smtp server gets a connect from that trojened comcast machine, my server checks with COMCAST DNS for spf, not his DNS...
You got that backwards. That is not what SPF does. If I have that wrong point me to a website that explains it is otherwise.
All SPF does is check the authoritative DNS for the DOMAIN name in the from field. It checks the DNS records for that domain name and makes sure there is an SPF record that shows the sending computers IP address. If spammer controls his own domain name then he can put any IP address he wants in the SPF record.
Check here: »spf.pobox.com/faq.html
And scroll down to the part where the headline is:
"It doesn't really prevent spam. Spammers can always get throwaway domains, etc."
Don't get me wrong, SPF is needed, to fix the virus bounces and the forged from address's in spam, it does a great job of that, but not much more. | |
|
|
|
|
·