Marc,
I implemented SPF for all of our customers domains, along with the microsoft
proposed mechanism. At the DNS, I added the following two lines to every zone file, assuming that my service network is on IP range 192.168.96.0 c-class /24 255.255.255.0 network.
---------
@ IN TXT "v=spf1 ip4:192.168.96.0/24 -all"
_ep IN TXT "<ep xmlns='http://ms.net/1'><out><m> <r>192.168.96.0/24</r> </m></out></ep>"
---------
I use XWall in front of my IMail Server. XWall, among other things, supports SPF on the receiving end. You have to define a "default" SPF entry for domains which don't have SPF implemented (yet). I use this "neutral" entry as default:
---------
v=spf1 ?all
---------
For some traveling users, I had to include various IP ranges of other ISPs. Then, there are some services (e.g. Yahoo Calendar) which "fake" the sender address fields on purpose. I had to include these too for the affected maildomains.
Usually, it is recommended to use SPF results in a weighing system to determine the spam probability. On the other hand, IF there is an SPF record defined for a maildomain, you should honor this info and mark "failed" lookups as spam.
Our policy is to pass on all mails (except virus infected mails) to the user. We just insert X-Headers which the user can check to sort his bad mails into his spamfolder.
Marius
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Funaro
Sent: Thursday, February 17, 2005 1:21 PM
To: iMail List
Subject: [IMail Forum] SPF records
Okay, so how many of you have implemented SPF in *your* DNS? And how many of you are actually able to use SPF as a valid check in your current filtering? What are you using to check SPF?
My understanding of SPF is, you could use it as part of your spam filtering process under the following conditions... please correct me if I'm wrong:
1. You have to have the software to support it (iMail does not have the ability to check SPF records for inbound mail)
2. The rule is basically, "if the FROM address domain does NOT have an SPF record, stop the SPF checking right there and do nothing to the message. If an SPF record DOES exist, trust its contents: If the FROM domain does not line up with the list of servers authorized to send on behalf of that domain, it's safe to reject the message".
Someone once published a location where a "tool" was provided, making generation of SPF records "easier" by asking you all the questions and then creating the record. Can someone point me to that location again?
Sorry if I've posed these questions in the wrong way, or have a complete misunderstanding of SPF... it's still new to me... I just know there was some sort of "deadline" for creating SPF records in your DNS, and we haven't done it yet... so I'm trying to get started on it ASAP.
Thanks,
Marc
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
