Ask Slashdot: How Do You Handle SPF For Spam Filtering? 187
An anonymous reader writes "Our organization had had a decent SPF record of our own for a long time. Recently, we decided to try using SPF for filtering inbound mail. On the up side, a lot of bad mail was being caught. On the down side, it seems like there is always a 'very important' message being caught in the filter because the sender has failed to consider all mail sources in writing their record. At first, I tried to assist sending parties with correcting their records out of hope that it was isolated. This quickly started to consume far too much time. I'm learning that many have set up inaccurate but syntactically valid SPF records and forgotten about them, which is probably the worst outcome for SPF as a standard. Are you using SPF? How are you handling false positives caused by inaccurate SPF records?"
don't reject based solely on SPF (Score:5, Insightful)
Or anything else, for that matter--mark it as "spf failed" and score it as you feel appropriate for your filtering setup.
Re:Do the right thing (Score:3, Insightful)
Some would say you are doing a disservice to your customers by continuing a practice that is hurting their business in an effort to promote a technology standard that is not working.
whitelist (Score:4, Insightful)
Use SPF as part of a whitelist/blacklist scheme.
For sources that have their shit together, trust their SPF records as an absolute metric.
SPF does work if set up correctly.
Re:Forget about them (Score:3, Insightful)
That works fine until the CEO misses an email from a prospective client.
Re:Forget about them (Score:4, Insightful)
If they are too stupid to set it up correctly, then they aren't the fools whom you are supposed to part with their money?!
"Too stupid" is exactly the kind of person I'm looking for!
It's the smart people I don't want to hear from. You know the people I'm talking about: the ones who are so smart that they don't have to work, they just program their botnet to send viagra spam and sit back and collect the money. I admire them, but they're useless to me.
Re:don't reject based solely on SPF (Score:5, Insightful)
This.
If email filtering was as simple as dropping non-SPF approved mail, spam would not exist. There is no single silver bullet in the war against spam. And besides, when domains cost a couple of dollars to register, it's entirely possible to set up an SPF enabled domain and spam from that.
Reject them immediately (Score:5, Insightful)
We reject mails which fail the SPF check immediately within the mail session. That is the only safe way, because then the sender will receive a bounce message from his own mail server.
We never received complaints regarding SPF rejects, but maybe because we do not have large incoming mail traffic.
Even if there were false positives, it would not hurt anybody, because the sender is guaranteed to be immediately notified that his message had not reached its recipient. He could contact us using a different method, not mail - in addition to complaining to his (so called) system administrators.
Re:Google does whatever it does (Score:4, Insightful)
Re:Forget about them (Score:5, Insightful)
And meanwhile in the real world where nailing some important email because the sender was sending all his email through a local MTA because his ISP doesn't have an externally accessible MTA, your boss is right now handing you your walking papers.
The only sane way to use SPF is to drop a spam score of an email. Outright filtering on bad or missing SPF records is just a recipe for a large number of false positives.
Re:Do the right thing (Score:5, Insightful)
Anyone who understands SMTP and spam knew from the very moment that SPF and its cousins/descendants were proposed that it was a hopeless measure. That, after ten years, guys like me are still having to explain "setting your SMTP server to reject because of SPF" tells you just how badly SPF failed.
Re:Forget about them (Score:2, Insightful)
Yup, pretty much. If you walk around - alone - wearing an "i'm with stupid" t-shirt, I don't care if you make Stephen Hawking look like Forest Gump, people will steer clear of you.
Pull your head out of your arse - in the real world, businesses need to communicate.
Yes. Yes, they very much do. And if they don't take that function seriously enough to make sure their audience can hear them, do you really want to do business with them?
They also need to make pay their bills - Do you also overlook your customers just "forgetting" to pay you because they have their AP system set up poorly?
Unless, of course, your core business depends on a steady stream of "bigger idiots", in which case, just reverse the polarity of the SPFion flux.
Re:We don't reject, but we send some "helpful info (Score:5, Insightful)
Please don't do this. One of the problems SPF solves is that spammers pick some random domain then spoof emails from that domain to send to millions of people. If you happen to be one of the unlucky people whose domain is targeted, you get a million bounces in your inbox.
The whole point of SPF is that if an email fails an SPF check, the email may not have come from the purported sender, and you should not treat it as genuine. You're completely undermining what SPF is for by doing this.
Re:Forget about them (Score:5, Insightful)
Yes, people would steer clear of someone who looks superficially stupid, that is a given. That isn't a defense of why you should steer clear of such a person though, especially if their skills and services are of particular use, or if they are a potentially big customer. By rejecting providers, you are going to tend to pay more for services because now you only look at a subset of potential providers, or by rejecting customers, you are rejecting sources of income. Either way, there is a cost associated with that. If it turns out it only costs you a couple hundred dollars in the long run, then maybe it is worth the saved effort by your IT department. If it is going to cost you much more, is it really worth it? How many thousands of dollars in extra costs or lost revanue is acceptable because you don't feel like dealing with such people?
It reminds me of when a coworker once started up a simple online store in his free time and offered me a bit of money to look over the front and backends while he still learned web development. I found out his website redirected IE users to a page telling them to get Firefox and didn't let them get to the actual store. As this was around 2005 or 2006, the logs showed that 90% of his traffic was being redirected to that page, including cases of people trying multiple times to get back to the product list. His response, "I don't want to deal with people too stupid to use IE, and I would have to waste time to make my site work on IE too." My response, "First, if I copy-paste your pages, they completely functional in IE as is. Second... you sell hot sauce, what do you care what browser people use?" He just brushed it off, and continued to insist that he didn't want to bother with such people. Considering he was able to get a couple hundred dollars a month after a bit of local promotion, and assuming there isn't some massive correlation between browser use and hot sauce purchasing, he chose not to turn that into couple thousand dollars a month over such superficial, trival BS.
So, exactly how much money would you give up because you want to tell a customer, "Sorry, we don't want to accept your email," even if your business dealt with products that has nothing to do with email otherwise?
Re:don't reject based solely on SPF (Score:2, Insightful)
And in the meantime SPF breaks mail for everyone whose email address is not hosted on the domain of the sending server. In other words, everyone who wants to send mail from their home PC with the From: address set to their webmail address through their ISPs mailserver.
If a technology breaks mail so fundamentally that an end user using best practices gets their email rejected, then the technology is broken.
Don't use SPF. It breaks mail.
Re:Forget about them (Score:5, Insightful)
That works fine until the CEO misses an email from a prospective client.
Unless you plan to profit from stupidity, that prospective client is worthless if they can't even set up a functional SPF record. Either you're too stupid to know about SPF or you do it right. Everything else is dumb beyond reason.
Lots of people are dumb as a brick when it comes to IT. Some of these people manage mail servers and DNS servers. Some of them want to buy stuff from your company. This makes their stupid misconfiguration your problem. Much though I'd enjoy burning these morons at the stake you can't burn your customers alive and expect them to keep buying from you. ( Unless you are Microsoft. )
Don't block on SPF - Use it as part of a spam scoring system.