Subject: TECH-OMISSION: billing.victim.com is possible

From: Daniel Quinlan <[email-masked]>
Date: Mon, 23 Aug 2004 16:35:20 -0700

Since Sender-ID is defined to be using the domain (RHS) of the email
address, all a spammer/phisher needs to do is fake their email to come
from "billing.victim.com" or some other undefined host.  Then, no
Sender-ID record will be defined.  No Sender-ID record is possibly
preferrable to a spammer/phisher to an SPF failure for "victim.com" or
an SPF pass for one of their own domains.

It may be sufficient to state that an implementation MAY fail or
softfail in check_host() domain if no SPF2, MX, or A record exists.

I don't think wildcards are a full solution, but they can be used as a
flawed workaround in some situations for this issue.  This is a plus in
the column for wildcards, I think (section 2.1.7 in -protocol).

-- 
Daniel Quinlan
http://www.pathname.com/~quinlan/

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 24 Aug 2004 08:38:26 +0200

On Mon, Aug 23, 2004 at 04:35:20PM -0700,
 Daniel Quinlan <[email-masked]> wrote 
 a message of 18 lines which said:

> all a spammer/phisher needs to do is fake their email to come from
> "billing.victim.com" or some other undefined host.
...  
> softfail in check_host() domain if no SPF2, MX, or A record exists.

IMHO, every sensibly managed MTA already refuses email from unexisting
addresses (smtpd_sender_restrictions = reject_unknown_sender_domain in
Postfix), so I do not see this as an issue. 

The lack of a MX or an A or an AAAA (meaning the message is
unreplyable) is a separate error (which is already addressed by
implementations).

[It has already been discussed on the spf-discuss list.]

The only thing to change should be to ask the MTA authors to allow the
testing of "unknown_sender_domain" to be performed on every address
used by the PRA algorithm.