I just got some eBay phishing scam e-mail, and SA failed to notice that this mail wasn't generated according to eBay's SPF policy.

Why? Because the envelope "mail from" information referred to "Return-Path: [EMAIL PROTECTED]" - a (forged) address that has nothing to do with eBay. They (aplus.net) don't have a SPF policy, so SA couldn't "up" a score based on SPF.

Isn't there a bit of a problem with SPF in this account? I understand from a MACHINE perspective, the envelope information is "truth", but from a human perspective, the From: header is who the message is from...

Sounds like a pretty easy workaround SPF. Doesn't this sort of kill the raison d'ĂȘe of SPF?

Jason



Reply via email to