On 9/16/22 10:57 AM, John Levine via mailop wrote:
Nope. SPF is somewhat useful as a signal that "this is real" but it is not useful, and -all is particularly not useful, as a signal that something is fake.*
I understand why you say that and acknowledge that a lot of people say the same thing.
However, as someone that has advocated for and has used SPF records that end in -all for more than a decade, I have to question the veracity of the sentiment behind your (and other's) statement(s) to that effect.
Maybe I live in / am exposed to too small of a world to sufficiently appreciate things the way that some people do.
There are way too many ways to send real mail that SPF cannot handle.
Again, I question the veracity of that. Rather I think that there are ways to deal with it and that not everybody does sufficiently deal with it.
I may be naive in my belief, but I do believe that you know how you operate your email better than I do, and that if you tell me that you only send email from X, Y, and Z, and that anything else is not from you, well, I'm going to believe you.
As for all the nominally outsourced marketing, well I think that's misconfigured way too often.
That's one of the reasons we have DKIM and DMARC, and we all know how much pain they have caused for mailing list mail that recipients actively want.
That gets into a different disagreement. I'm sending this message to the mailop mailing list. I'm not sending it to you John L, or any other subscriber in particular. I view the mailing list as a terminal point. The email, as an SMTP envelope and contents, is between my MUA and the mailing list MUA. The mailing list is the terminus of the message that I'm typing. The mailing list is also a origination point of a new message substantively based on the contents of my message. But it is not my email. As such, I fully believe that the emails that the mailing list sends should be wholly from the mailing list, perhaps with my name in the human friendly part of the from address while the actual email address reflects the mailop mailing list. -- I say this to say that in my head, SPF, DKIM, and DMARC are all perfectly compatible with how I believe things should work. Anything that falls short is a misconfiguration /in/ /my/ /opinion/.
-- Grant. . . . unix || die
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
