Re: [mailop] Blocking emails from domains without SPF records

2016-08-19 Thread Dave Crocker
An SPF pass is a reasonably strong signal that the mail did come from the purported source. An SPF fail doesn't tell you much. The basic rule is that without any established track record, any 'directive' from a sender, about how a receiver should handle received mail, is strongly like to h

Re: [mailop] Blocking emails from domains without SPF records

2016-08-19 Thread John Levine
In article <27d11417-6cdf-62cf-3d97-7a4e5581b...@blakjak.net> you write: >Perhaps i've missed something, but isn't the whole point of SPF that if >a _sender domain_ publishes a -all SPF record, that any platform using >SPF is _supposed to reject email that doesn't pass_ ? Ten years ago there wer

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Franck Martin via mailop
I think we were talking here about rejecting emails from a domain that do not have a SPF policy, which is a bit different from rejecting emails from a domain with a SPF policy "-all" and a fail result. For IPv6, bad stuff happens to non authenticated emails , as the archive on this list is chowing

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Michelle Sullivan
Mark Foster wrote: By 'configured to do so', does Michelle mean , well, obeying SPF? Yes I mean if the receiving server is both checking SPF and enforcing the policy configured ;-) (sorry I did a really bad job of being clear :) ) -- Michelle Sullivan http://www.mhix.org/ _

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Michelle Sullivan
Steve Atkins wrote: Anyone who is sending mail over IPv6 has touched the network recently enough that they don't have that excuse, and it's not unreasonable to hold them to a slightly higher standard. 100% with you on that... but you know the way it is... the more people start using ipv6 the

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Steve Atkins
> On Aug 17, 2016, at 2:38 PM, Michelle Sullivan wrote: > > Franck Martin wrote: >> I don't think you should block however: > > I'm not making any call either way - it's upto the admins involved. > Personally I have a valid SPF record my milter I wrote and build from scratch > the other week

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Mark Foster
Perhaps i've missed something, but isn't the whole point of SPF that if a _sender domain_ publishes a -all SPF record, that any platform using SPF is _supposed to reject email that doesn't pass_ ? Forwarded email is going to cause an SPF failure, unless the envelope-sender is rewritten (ala ma

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Michelle Sullivan
Franck Martin wrote: I don't think you should block however: I'm not making any call either way - it's upto the admins involved. Personally I have a valid SPF record my milter I wrote and build from scratch the other week uses libspf2 to make determinations on whether to accept or reject ema

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Franck Martin via mailop
I don't think you should block however: -IPv4 rate limit if the email is not authenticated (pass SPF or DKIM) -IPv6 reject email if it is not authenticated (pass SPF or DKIM) On Wed, Aug 17, 2016 at 12:23 PM, Michelle Sullivan wrote: > Brandon Long via mailop wrote: > >> If your mail server doe

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Michelle Sullivan
Brandon Long via mailop wrote: If your mail server doesn't expect to get forwarded mail, I can see using SPF like that. If you do expect to get forwarded mail, then it seems likely to cause more false positives than it's worth. I don't see that... Renaud just quoted https://www.iplocatio

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Brandon Long via mailop
If your mail server doesn't expect to get forwarded mail, I can see using SPF like that. If you do expect to get forwarded mail, then it seems likely to cause more false positives than it's worth. Brandon On Wed, Aug 17, 2016 at 6:41 AM, Al Iverson wrote: > It's kind of a moot point. Not many

Re: [mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Al Iverson
It's kind of a moot point. Not many sites block mail lacking SPF today, but the longer you send mail from a domain without an SPF record, the more likely you are to eventually run into woe. So your point is valid, but only in a pretty limited way. I'd say add the SPF record. Gmail doesn't say that

[mailop] Blocking emails from domains without SPF records

2016-08-17 Thread Renaud Allard via mailop
Hello, I am following another message which suggested that btinternet.com was blocking emails from domains without SPF records. This website suggests this is "common practice" in point 4: https://www.iplocation.net/email-delivery-problems Do you have this kind of policy or any evidence of this be