|
All Archives /
aussie-isp /
2005-06
|
<<< Date >>> | |
| Permanent Link | ||
|
Date: Sun, 12 Jun 2005 13:03:28 +1000
From: Craig Sanders To: Oz-ISP, aussie-isp Message-Id: <20050612030327.GD6237@taz.net.au> In-Reply-To: <Pine.BSF.4.33.0506111840570.1517-100000@home.albury.net.au> References: <200506110137.j5B1b3EI030170@mailout2.pacific.net.au> <Pine.BSF.4.33.0506111840570.1517-100000@home.albury.net.au> Subject: Re: [Oz-ISP] Helo Pacific |
Followups: <20050612070437.GK6237@taz.net.au> |
|
On Sat, Jun 11, 2005 at 06:44:42PM +1000, Ross Wheeler wrote: > Ones that clearly work like this are: > yahoo > hotmail > msn > aol > microsoft > westpac.com.au > citibank.com > > Probably thousands of others too, but certainly these ones I *DO* > check in the helo/ehlo exchange, and if they ain't who they claim to > be, they get dropped quick smart. this is one thing that SPF is good for(*)....use it to check not only envelope-From addresses, but also HELO/EHLO names. fortunately, some of the popular services above (e.g. aol, hotmail, and msn) do publish SPF records in their DNS. in fact, yahoo and westpac are the only domains in the list above that don't publish SPF records. yahoo probably because they have their own domain-keys anti-forgery thing (which seems vastly more complicated without any noticable advantage over SPF) and westpac presumably because they're ignorant. (*) contrary to misguided popular opinion, SPF is *NOT* a spam-blocking device, it is an anti-forgery device. it allows the owner of a domain to specify which hosts are allowed to send mail claiming to be from that domain. if more banks used it, then phishing would be nowhere near as significant a problem. citibank.com, at least, publishes an SPF record. too bad westpac doesn't have enough clue to do that. actually, it looks like all the australian banks are clueless about this - NONE of the australian banks i queried publish SPF records. craig -- craig sanders <c a s @ t a z . n e t . a u (part time cyborg) ---- email "unsubscribe aussie-isp" to m a j o r d o m o @ a u s s i e . n e t to be removed. |
|