SPF, DomainKeys are not anti-spam technologies- They may ultimately prevent the use by spammers of spoofed addresses in, for example, yahoo.com but they will not prevent the use by spammers of any domain which either has no published SPF/DomainKeys information or which actually belongs to the spammer.
- Also (and the reason for this rant), the presence of valid SPF during message delivery or of a valid DomainKeys signature in a delivered message are not in and of themselves indications that that same message is not itself spam.
Users have reported a brace of 419 spams from Yahoo! today. One, being from a yahoo.co.uk address bears no DomainKeys signature (they have evidently yet to implement DomainKeys for their .co.uk domain). The other from a yahoo.com address does have a DomainKeys signature. And as well as the header bearing the DomainKeys signature, it also helpfully offers this header directly above that DomainKeys header:
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
I hope the irony of this is not lost on the Yahoo! abuse team or on you, gentle reader.
Category: Fixing SMTP
Technorati: Fixing SMTP
1. Eric Parsons23/02/2005 18:35:09
Homepage: http://www.startingblockcomputing.com
Those who don't know irony, also need to look up subtlety. DomainKeys are antispam, like drivers licenses are anti traffic accidents.
2. Nathan T. Freeman24/02/2005 08:00:11
And what processes *really* prevent traffic accidents?
Traffic lights
Adjustable insurance premiums
Anti-lock brakes & traction control
Traffic police monitoring & fines
Driving conventions and right-of-way rules
The observation of these things has nothing whatsoever to do with the possession of a driver's license. The license is a secondary layer that technically demonstrates that you understand the last item above, much like a professional certification. But you can understand and follow driving conventions without actually being licensed.
3. Jon Johnston28/02/2005 21:22:59
Homepage: http://bingo.cbsol.com
The biggest problem is that (at least at this point), more spamming organizations have signed up to use SPF than have real businesses. It's doubtful that SPF will have any significant impact on antispam.
4. Chris Linfoot28/02/2005 22:09:39
Quite so. And see this which I posted earlier today for another example of a missed SPF opportunity.
http://chris-linfoot.net/d6plinks/CWLT-6A2GBJ
Unable to post a comment? Please read this for a possible explanation...
- 
