SPF deployment by Oct. 1 ?

Wed Jul 28 02:38:28 UTC 2004

On Mon, 26 Jul 2004 Valdis.Kletnieks at vt.edu wrote:
> On Mon, 26 Jul 2004 11:51:26 EDT, Gerald said:
> 
> > I think this will be the next best thing in E-mail. I'd love for that date
> > to be August 1 though.
> 
> OK... Aug 1 is a weekish away.   Check your inbound mail for today, and ask
> yourself how much you'd be losing if you started enforcing SPF today, and what
> percentage of the sites you get legitimate mail from are likely to deploy SPF
> tags this week.....

Just checking if I have this correct:

>From what I understand the fall back for SPF to use the MX record and then
the A record if that isn't found, which covers alot of the net, how much?
Does anybody have any SPF compliance measurements (exclude spam) from
their production mail servers that they can share?

Organizations that have separate outgoing mail servers from incoming mail
servers will need to define SPF records.

Mail forwarding to other domains on a per user basis (i.e. using .forward)
without updating an organizations SPF record will fail the SPF check.

The SPF check is based on the envelope sender and not the message from, so
it won't break as many mailing lists as it would first seem.

> And then keep in mind that SPF is *known* to break certain types of mail
> reflectors and forwarding (argue all you want about whether such things are
> fundementally broken - they're still *in production use*)....

1 percent?  5 percent?  0.1 percent?

(of course this depends on all kinds of things)

Then the other question is do we have any kind of figures for how much
spam currently fails the SPF check in any known test?

Even if SPF doesn't end up blocking very much spam, if it blocked most
worms and viruses, that might be worth while.

Mike.

+----------------- H U R R I C A N E - E L E C T R I C -----------------+
| Mike Leber           Direct Internet Connections   Voice 510 580 4100 |
| Hurricane Electric     Web Hosting  Colocation       Fax 510 580 4151 |
| mleber at he.net                                       http://www.he.net |
+-----------------------------------------------------------------------+