> -----Original Message----- > From: Matus UHLAR - fantomas [mailto:[EMAIL PROTECTED] > Sent: Saturday, August 04, 2007 4:08 AM > To: users@spamassassin.apache.org > Subject: Re: hallmark greeting card spam and broken spf records. > > > > On Friday 03 August 2007, Michael Scheidell wrote: > > > (yes, spf is broken) especially when companies like hallmark, who > > > know they are being used as 'phishing' targets list the > whole world > > > as authoritative mail servers. > > That does not mean "spf is broken". MX is not broken when > someone sets his MX to 127.0.0.1. It's just "their spf > settings are broken". > Issue #1: Irelevant, that has nothing to do with it. I use SPF, but it cannot be trusted. Its broken. Has nothing to do with 127.0.0.1, and where is the straw man that set his mx to 127.0.0.1?
#2, hallmark ITSELF has broken spf records (componds the problem) #3, the SPF plugin is broken, it sets SPF_PASS on hallmarks broken spf record. #4, if I go to 'joesnewsite.com' and email a link to a friend, 'joe' is too stupid to set the correct headers, and the person I send to might bounce it since joe isn't an authoritative server. #5, the ~ and ? Records are stupid, and should be totally ignored by SPF plugins. #6, SPF could not have been used in this specific case to block a 'phish' hallmark card since due to one of many of the above issues, the SA supported SPF plugins VALIDATED the source as 'SPF_PASS' for the phishing email. SPF is broken. (but I do use it, I publish SPF and SENDER-ID records, and use them in scoring, even though SPF is broken) Follow the thread from the beginning, maybe it will make more sense to you. _________________________________________________________________________ This email has been scanned and certified safe by SpammerTrap(tm). For Information please see http://www.spammertrap.com _________________________________________________________________________
