> > > > Actually in some ways this leads to an interesting idea. In our wiki > here perhaps we should write some guidelines for banks and everyone else > running legitimate email servers as to what is the correct way to > configure their servers. The first thig that come to mind is getting > FCrDNS correct and making sure that the domain of the from address, the > HELO, and FCrDNS all resolve to the banks domain. >
That is not practical. Atleast in India, Banks use third party servers to send their mailers often. And the ips have PTR's & HELO's which dont match the banks', because these dont belong to the bank I do something like this. ((! SPF_PASS ) && ( ENV_FROM_GOOD_BANKS || HEADER_FROM_GOOD_BANKS) ) then give a score 3.0 Of course the GOOD_BANKS are a list of bank which have SPF records. Thanks Ram
