https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5684
--- Comment #17 from [email protected] 2010-11-16 13:49:29 UTC --- Having "+all" can also be a sign of 1) A lazy admin., or 2) one who really doesn't care*. Regardless, SPF is not a spam solution but a forgery solution. Granted, much spam is also forged, but so can non-spam be forged. Deferring action to the data phase where SA gets the message is too late in the SMTP transaction. * - Especially if another anti-forgery method (DK/DKIM or PGP signatures) is always deployed in messages from that source, there should be no such conclusion, implied or not, that the source may be "spammy" in nature just because it has "+all" in its SPF record. However, I personally would deny such a result (pass -> "+all") anyway at SMTP "MAIL FROM", thus such would never reach SA to be evaluated. As far as statistics go as to how many sites have SPF records with "+all", that need not be done with a mail server. In fact, some work has already been done - see http://spf-all.com/stats.html for details. The survey at that web site identifies roughly a 10% infiltration of SPF across all domains sampled, and within that 10%, 1/100 have "+all" terminated records (26k of 2.6M out of 25.6M domains sampled). A larger number of domains have SPF record errors than "+all". -- Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug.
