Stopping spam and worms with SPF [closed]

Question

Sender Policy Framework is a system to detect spoofed emails.

From http://www.libsrs2.org/overview.html :

WHAT EMAIL FORWARDING SERVICES NEED TO KNOW ABOUT SPF

To combat spams, worms, and viruses, the new anti-forgery standard called SPF adds a layer of protection to SMTP. When an SPF-aware MTA receives mail (from, say, username@aol.com ), it asks the envelope sender’s domain ( aol.com ) if it recognizes the IP address of the SMTP client. The domain publishes SPF records in DNS describing its outbound servers, as a sort of “Reverse MX” record. If those records do not describe the client IP, the MTA may reject the SMTP transaction as a forgery attempt.

How can SPF help in detecting and preventing spam and worms?

I would point out that perfectly legitimate emails can be erroneously caught by SPF too, > say registration confirmation or password reset email sent direct from webserver that has > different IP address than the mail server). – ewanm89

So have the web server talk to the mail server to send and not send directly. slow, more resources but ultimately a good cause?

Answer 1

SPF records stop one particular type of spam, but only one type.

As the owner of example.com I know what the IP addresses of my mail servers are. I can publish a DNS record that lasts these IP addresses and a policy for other mail servers to follow when receiving mail that claims to be from my domain example.com.

That's the type it stops. It stops spammers pretending to be me.

SPF doesn't stop spammers who own their own domain or spammers who have control over my mail servers or spammers who are abusing my open relay or spammers who send spam from Yahoo, Gmail and Hotmail accounts.

Along the same lines as SPF is DKIM which works in a different way but achieves much the same goal, allowing the recipient to be certain that the email actually originated from the sender that it claims to be from. (Technical detail: SPF validates the MAIL FROM address, DKIM validates the From: header and potentially other headers.)

DMARC is a specification designed to consolidate the different ways that different vendors handle SPF and DKIM and allow senders to know what has happened to their email and to declare what should be done with it.

Neither of these do anything more than SPF. Each of SPF, DKIM and DMARC attempt to fix the problems with the others but are still trying to solve the same problem. SRS is an attempt to solve one of the problems with SPF and email forwarding. It doesn't do anything more to prevent spam other than making SPF work more often, hence motivating more people to switch SPF on.

All the other problems with spammers still exist.

These specifications have nothing to do with stopping worms.