Security management Toolkit
Story: One giant step towards ending spam
Posted by: Anonymous (Tuesday 13 April 2004, 11:39 AM)
As I understand it, SPF will stop anyone from sending mail via an ISP which does not host their domain.
This means customers will be required to host their domain with the same provider as their dial-up connection, since the constraint on open relay means email senders always need to send smtp via the SMTP server at the ISP they dial in to.
This will be an issue for many small businesses which use dialup/adsl, do not run an email server to do dns lookups and send direct, and use a separate web hosting provider, which by necessity must host their domain, but doesn't provide smtp or dialup/adsl.
So this will have 2 effects
1. reduction in customer choice - you cannot pick a different web host from your connectivity isp
2. hosting only providers will no longer be able to operate unless they add smtp servers which can authenticate relaying senders.
No doubt ISPs love this, as it ties customers into buying more services from them, and big businesses are unaffected as they run their own smtp server. How many small businesses are represented in the group devising the standard? Those ISPs with significant small business customer-bases will probably have to provide a SPF-optout service to keep their customers (which the spammers will use).
In any case, spam friendly ISPs in less-well-regulated countries, and worms which use brute force attacks and dns lookup to get a legitimate sender address for a compromised PC used as a relay will soon render SPF ineffective, and spammers are very quick to exploit any loophole.
I doubt therefore whether SPF will have more than a fleeting impact.
Full Talkback thread
