-2

Sender Policy Framework is a system to detect spoofed emails.

From http://www.libsrs2.org/overview.html :

WHAT EMAIL FORWARDING SERVICES NEED TO KNOW ABOUT SPF

To combat spams, worms, and viruses, the new anti-forgery standard called SPF adds a layer of protection to SMTP. When an SPF-aware MTA receives mail (from, say, username@aol.com ), it asks the envelope sender’s domain ( aol.com ) if it recognizes the IP address of the SMTP client. The domain publishes SPF records in DNS describing its outbound servers, as a sort of “Reverse MX” record. If those records do not describe the client IP, the MTA may reject the SMTP transaction as a forgery attempt.

How can SPF help in detecting and preventing spam and worms?

I would point out that perfectly legitimate emails can be erroneously caught by SPF too, > say registration confirmation or password reset email sent direct from webserver that has > different IP address than the mail server). – ewanm89

So have the web server talk to the mail server to send and not send directly. slow, more resources but ultimately a good cause?

|improve this question

closed as not constructive by Scott Pack, Adi, TildalWave, AJ Henderson, NULLZ Jun 10 '13 at 23:01

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Question gets down voted but answer gets upvoted! /errors – tgkprog Jun 10 '13 at 20:04
  • There isn't a clear question here. What are you asking exactly? – schroeder♦ Jun 10 '13 at 21:40
  • And why did you repeat comments in your question? – schroeder♦ Jun 10 '13 at 21:41
5

SPF records stop one particular type of spam, but only one type.

As the owner of example.com I know what the IP addresses of my mail servers are. I can publish a DNS record that lasts these IP addresses and a policy for other mail servers to follow when receiving mail that claims to be from my domain example.com.

That's the type it stops. It stops spammers pretending to be me.

SPF doesn't stop spammers who own their own domain or spammers who have control over my mail servers or spammers who are abusing my open relay or spammers who send spam from Yahoo, Gmail and Hotmail accounts.

Along the same lines as SPF is DKIM which works in a different way but achieves much the same goal, allowing the recipient to be certain that the email actually originated from the sender that it claims to be from. (Technical detail: SPF validates the MAIL FROM address, DKIM validates the From: header and potentially other headers.)

DMARC is a specification designed to consolidate the different ways that different vendors handle SPF and DKIM and allow senders to know what has happened to their email and to declare what should be done with it.

Neither of these do anything more than SPF. Each of SPF, DKIM and DMARC attempt to fix the problems with the others but are still trying to solve the same problem. SRS is an attempt to solve one of the problems with SPF and email forwarding. It doesn't do anything more to prevent spam other than making SPF work more often, hence motivating more people to switch SPF on.

All the other problems with spammers still exist.

These specifications have nothing to do with stopping worms.

|improve this answer
  • okay. i have this issue, own a site and occasionally get mail to my catch all about failed delivery. i guess spammers are pretending to be me and sometimes mail inactive accounts – tgkprog Jun 8 '13 at 20:32
  • 1
    I would point out that perfectly legitimate emails can be erroneously caught by SPF too, say registration confirmation or password reset email sent direct from webserver that has different IP address than the mail server). – ewanm89 Jun 9 '13 at 15:15
  • thank you for pointing that out, wish the article was complete. The work around : have the web server talk to the mail server to send and not send directly. slow, more resources but ultimately a good cause? – tgkprog Jun 10 '13 at 20:05
  • 2
    I choose to have my web servers relay via one of my mail servers but you could easily add the web servers to your SPF records instead. The firewall prevents my web servers sending mail directly. SPF records support CIDR notation so you can list your entire range easily. If you don't list all your servers that send mail, that's a configuration problem, not a flaw in the design of SPF. – Ladadadada Jun 11 '13 at 7:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.