Re: [CORE] SPF Record ...

Dan Langille wrote:
> On 18 Nov 2006 at 18:12, Dave Page wrote:
>
>>
>>> ------- Original Message -------
>>> From: "Marc G. Fournier" <scrappy@hub.org>
>>> To: Peter Eisentraut <peter_e@gmx.net>, pgsql-www@postgresql.org
>>> Sent: 18/11/06, 17:38:45
>>> Subject: Re: [pgsql-www] [CORE] SPF Record ...
>>>
>>> That is not true .. that is only true if we publish -all ... if we publish
>>> ?all, we are saying that anything coming from "a mx" are *definitely* from
>>> @postgresql.org, and that from other sources they *might* be ...
>> So what's the point then? People either ignore the SPF record, or
>> refuse mail from the 'might be's'.
>
> These are inaccurate conclusions.  SPF information helps to draw a
> conclusion.  Consider it a points system.    Get so many points for a
> might be, none for a definitely.  Get enough points, you're spam.
> SPF is most wisely used in conjunction with other information to
> reach a conclusion.

Yes, so the net result of not running ?all is that you don't block real
spam as a result of SPF any more than you block legitimate mail from one
of the 'allowed but not listed servers'.

Seems to me all that risks is increasing the spam score of legitimate
users who have real reasons for using different outgoing servers.

Regards, Dave.