https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5684

--- Comment #17 from [email protected] 2010-11-16 13:49:29 
UTC ---
Having "+all" can also be a sign of 1) A lazy admin., or 2) one who really
doesn't care*.  Regardless, SPF is not a spam solution but a forgery solution. 
Granted, much spam is also forged, but so can non-spam be forged.  Deferring
action to the data phase where SA gets the message is too late in the SMTP
transaction.

* - Especially if another anti-forgery method (DK/DKIM or PGP signatures) is
always deployed in messages from that source, there should be no such
conclusion, implied or not, that the source may be "spammy" in nature just
because it has "+all" in its SPF record.  However, I personally would deny such
a result (pass -> "+all") anyway at SMTP "MAIL FROM", thus such would never
reach SA to be evaluated.

As far as statistics go as to how many sites have SPF records with "+all", that
need not be done with a mail server.  In fact, some work has already been done
- see http://spf-all.com/stats.html for details.  The survey at that web site
identifies roughly a 10% infiltration of SPF across all domains sampled, and
within that 10%, 1/100 have "+all" terminated records (26k of 2.6M out of 25.6M
domains sampled).  A larger number of domains have SPF record errors than
"+all".

-- 
Configure bugmail: 
https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

Reply via email to