Mailing List Archive: Re: SPF and usernames (fwd)

Re: SPF and usernames (fwd)

Jul 8, 2009, 9:54 AM

Post #1 of 5 (2880 views)

Paul, I really don't see where your argument is headed. Without SPF, the
whole world can spoof your domain and get away with it. With a proper SPF
policy which allows the hotmail servers to send on your behalf, you can
restrict possible spoofing to hotmail servers only, while the others'
attempts to spoof get junked (if the recipient is using SPF checking, that
is). Isn't this beneficial? You stand to gain and not lose by implementing
SPF, so what is the need to term SPF a curse?! Sheesh!

Regards,
Prashanth Chengi
National PARAM SuperComputing Facility
System Administration and Networking Group
C-DAC Pune
Ext-183
Mob: 09766044870

--
He who fights with monsters might take care,
lest he thereby become a monster.
-Friedrich Nietzsche

On Wed, 8 Jul 2009, Paul D.Smith wrote:

> Rob,
>
> Thanks for the response - very clear. A few comments in-line below marked
> [PDS].
>
> Paul DS.
>
>>> Next is the checking of the MAIL FROM. Now this does not indicate the
>>> Hotmail domain so the SPF look-up for the MAIL FROM domain does not return
>>> a
>>> valid Hotmail IP address and this would result in my mail being rejected.
>>
>> No, the Mail From is checked against the domain provided in the Mail
>> From. If you are sending from your own domain then it will be your
>> domain's SPF record that is checked.
>
> [PDS] Whoa, where does the value of the address in "MAIL FROM" come from
> then? As an example, most e-mail packages I've seen (I use Windows Live to
> type this) allow two fields to be specified, named "e-mail address" and
> "reply address" or similar. Normally I would set these to be the same but
> then that doesn't seem to make sense to me because MAIL FROM and "From
> header" would be the same and then I can't see how there is a problem?
>
>>> Now at this point, how could I ensure my mail gets through?
>>>
>>> 1. I could have an "allow all" SPF record for my domain - very bad, well in
>>> fact exactly as pre-SPF.
>>
>> Correct.
>>
>>> 2. I could add all the IP addresses for Hotmail to my SPF records for my
>>> real domain. But then anyone with a Hotmail account can spoof me sending
>>> from my domain - still not good and providing little protection for the
>>> recipient or for me as being anti-forged.
>>
>> Correct.
>>
>>> 3. I can similar to #2 except I put "hotmail.com" servers into the SPF
>>> records such that my domain opens up Hotmail.com senders but without the
>>> need for me to explicitly add IP addresses - still not good.
>>
>> Correct - and indeed it's identical to (2).
>>
>>> This is why I
>>> was giving the Y.com/X.com example - I would be allowing
>>> <anyone>@hotmail.com to send as my@mydomain.com whereas in fact I only want
>>> to allow me-hotmail@hotmail.com to be able to do this.
>>
>> No, you'll be allowing anybody who is allowed to send email through
>> Hotmail's servers to send email from your domain and pass the SPF
>> checks. Remember, that's the point of the SPF record, it identifies
>> which hosts are allowed to send email on behalf of a domain.
>
> [PDS] We may be saying the same thing here in two different ways. Are you
> saying that for example "noddy@hotmail.com" could send an e-mail which would
> reach you and look as if it were sent from mydomain.com? Or are you saying
> that somehow I have allowed the user whose address is noddy@hotmail.com to
> use mydomain.com's servers to send an e-mail that appears to have come from
> Hotmail servers?
>
>>
>>> At this point I can't do anything more because SPF is unable to get access
>>> to "me-hotmail@hotmail.com" and therefore cannot perform "true sender"
>>> checking (in fact this information is present in a Hotmail X-header - but
>>> let's not go there).
>>
>> Correct - however it is important to note that:
>>
>> a) SPF was never designed with this in mind - it is intended to
>> protect domains, not individual accounts
>> b) At no point is there any way for anything outside of Hotmail to
>> know anything about the Hotmail account that's linked to your own
>> domain
>>
>> Also, it's important to note that Hotmail uses Sender-ID, not SPF.
>> The 2 are similar, but not the same.
>>
>>> So, I seem to be able to only do the following...
>>>
>>> - Allow anyone to forge me
>>> - Allow nobody to forge me (where I might legitimately want to forge
>>> myself)
>>> - Allow anyone on an entire specified domain to forge me.
>>
>> Assuming you only use SPF, yes. However as stated in the SPF FAQ, it
>> isn't intended to be a complete solution to the problem of mail
>> forgery, it is intended to only protect one part of the problem.
>
> [PDS] The follownig may be wrong depending on answers to my comments above.
> OK, options 1 and 3 I understand but option 2 looks like a very small case.
> Who realisticly controls a second domain so tightly as to be happy to enable
> it to send on behalf of their first domain? Surely the second domain being
> "open" like Hotmail is a much more common occurence?
>
> -------------------------------------------
> Sender Policy Framework: http://www.openspf.org
> Modify Your Subscription: http://www.listbox.com/member/
> Archives: https://www.listbox.com/member/archive/1020/=now
> RSS Feed: https://www.listbox.com/member/archive/rss/1020/
> Powered by Listbox: http://www.listbox.com
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

Re: SPF and usernames (fwd) [ In reply to ]

paul_d_smith at hotmail

Jul 13, 2009, 1:49 AM

Post #2 of 5 (2766 views)

Permalink

My answer to your question this is:

- I accept that spoofing is a problem and a solution would be good.

- I accept that SPF reduces the scope of the problem a little.

- But spoofing can also be very legitimate, as SPF permits.

The problem is that SPF only limits spoofing by domain and not by user (and
I appreciate that the latter is technically almost impossible at present).
ISPs are (rightly I suppose) trying to use SPF to reduce SPAM through their
systems but they are, quite sensibly, blocking ensitre domains such as
Hotmail.com - the very same free domains that small users such as myself
rely on using.

So whilst SPF clearly does solve one problem, it creates others. As it
stands, SPF means I cannot send "personal" e-mails during my lunch hour
(actually on behalf of a small political organisation) because of a
combination of blocked POP3/SMTP access by my employers and now SPF meaning
I can't use the "spoofing" Hotmail account that I've used for the last 4
years to achieve this via the web.

I wonder if there is mileage in the following extension to SPF based on a
chain of trust?

1. As now, SPF validates a domain (say Hotmail.com) as being able to spoof
on behalf of X.com

2. Having now trusted Hotmail.com, and been happy that the sending server IP
does identify Hotmail, expect and trust Hotmail to also provide a specific
"this is the real sending user" header (Hotmail in fact already does this
using the "X-Originating-Email" header).

[.Aside - SPFv2 should define this new header and it should be proposed as an
extension to base e-mail].

3. Now you can validate on a per-user basis.

Paul DS.

--------------------------------------------------
From: "Prashanth Chengi" <prashanthd@cdac.ernet.in>
Sent: Wednesday, July 08, 2009 5:54 PM
To: <spf-help@v2.listbox.com>
Subject: Re: [spf-help] SPF and usernames (fwd)

> Paul, I really don't see where your argument is headed. Without SPF, the
> whole world can spoof your domain and get away with it. With a proper SPF
> policy which allows the hotmail servers to send on your behalf, you can
> restrict possible spoofing to hotmail servers only, while the others'
> attempts to spoof get junked (if the recipient is using SPF checking, that
> is). Isn't this beneficial? You stand to gain and not lose by implementing
> SPF, so what is the need to term SPF a curse?! Sheesh!
>
> Regards,
> Prashanth Chengi
> National PARAM SuperComputing Facility
> System Administration and Networking Group
> C-DAC Pune
> Ext-183
> Mob: 09766044870

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

Re: SPF and usernames (fwd) [ In reply to ]

spf.pobox at logicalsolutns

Jul 13, 2009, 7:01 AM

Post #3 of 5 (2774 views)

Permalink

At 03:49 AM 7/13/2009, you wrote:
>My answer to your question this is:
>
>- I accept that spoofing is a problem and a solution would be good.

There will probably never be 'a single' solution.

So we are left with using various combinations of solutions to get as close as possible to the ultimate goal.

>- I accept that SPF reduces the scope of the problem a little.
>
>- But spoofing can also be very legitimate, as SPF permits.

I think you mean "AND spoofing can be legitimate, as SPF permits."

>The problem is that SPF only limits spoofing by domain and not by user (and I appreciate that the latter is technically almost impossible at present). ISPs are (rightly I suppose) trying to use SPF to reduce SPAM through their systems but they are, quite sensibly, blocking ensitre domains such as Hotmail.com - the very same free domains that small users such as myself rely on using.

ISPs that are using SPF will not block your HOTMAIL-spoofed email (due to SPF), unless you have configured SPF for your domain, thus requesting that they do so.

>So whilst SPF clearly does solve one problem, it creates others. As it stands, SPF means I cannot send "personal" e-mails during my lunch hour (actually on behalf of a small political organisation) because of a combination of blocked POP3/SMTP access by my employers and now SPF meaning I can't use the "spoofing" Hotmail account that I've used for the last 4 years to achieve this via the web.

As long as we agree that it doesn't prevent you from sending email.

Technically, if your employer has blocked SMTP, it probably means they do not want you sending email from work. So using the Hotmail website may actually be circumventing their policies.

Secondly, your ISP (or your domain's mail server) probably also has webmail functionality. In which case, you could send mail directly from your domain and not need hotmail.

Thirdly, your ISP (or your domain's mail server) should have port 587 open for relay mail authentication. Port 587 is used for sending/relaying mail to/through a mail server using authenticated sessions.

Southwestern Bell (and AOL I believe) block port 25 going out of their network, but they do not block port 587. So my customers are unable to use outlook to send mail through my server on port 25, but they can easily change that to port 587 and send mail successfully.

SPF does not prevent you from using Hotmail, and there are probably much better (more professional) methods available to you than Hotmail.

As for specific user exceptions, I would recommend looking into Domain Keys as yet another contribution to reducing spam.

Note, installing neither SPF nor Domain Keys will reduce your spam. Both are things that you do to help other people reduce the amount of spam they accept.

The fact that it requires action (installation) on the part of someone else, in order for you to achieve any benefit is why SPF (and/or Domain Keys) will probably never be "the" ultimate solution.

-john

>I wonder if there is mileage in the following extension to SPF based on a chain of trust?
>
>1. As now, SPF validates a domain (say Hotmail.com) as being able to spoof on behalf of X.com
>
>2. Having now trusted Hotmail.com, and been happy that the sending server IP does identify Hotmail, expect and trust Hotmail to also provide a specific "this is the real sending user" header (Hotmail in fact already does this using the "X-Originating-Email" header).
>
>[.Aside - SPFv2 should define this new header and it should be proposed as an extension to base e-mail].
>
>3. Now you can validate on a per-user basis.
>
>Paul DS.
>
>--------------------------------------------------
>From: "Prashanth Chengi" <prashanthd@cdac.ernet.in>
>Sent: Wednesday, July 08, 2009 5:54 PM
>To: <spf-help@v2.listbox.com>
>Subject: Re: [spf-help] SPF and usernames (fwd)
>
>>Paul, I really don't see where your argument is headed. Without SPF, the whole world can spoof your domain and get away with it. With a proper SPF policy which allows the hotmail servers to send on your behalf, you can restrict possible spoofing to hotmail servers only, while the others' attempts to spoof get junked (if the recipient is using SPF checking, that is). Isn't this beneficial? You stand to gain and not lose by implementing SPF, so what is the need to term SPF a curse?! Sheesh!
>>
>>Regards,
>>Prashanth Chengi
>>National PARAM SuperComputing Facility
>>System Administration and Networking Group
>>C-DAC Pune
>>Ext-183
>>Mob: 09766044870
>
>
>
>-------------------------------------------
>Sender Policy Framework: http://www.openspf.org
>Modify Your Subscription: http://www.listbox.com/member/
>Archives: https://www.listbox.com/member/archive/1020/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/1020/
>Powered by Listbox: http://www.listbox.com
>
>
>No virus found in this incoming message.
>Checked by AVG - www.avg.com
>Version: 8.5.375 / Virus Database: 270.13.12/2234 - Release Date: 07/12/09 17:56:00

Re: SPF and usernames (fwd) [ In reply to ]

paul_d_smith at hotmail

Jul 13, 2009, 8:03 AM

Post #4 of 5 (2770 views)

Permalink

Some comments in-line marked [PDS] purely FYI...

...snip....
>
>>The problem is that SPF only limits spoofing by domain and not by user
>>(and I appreciate that the latter is technically almost impossible at
>>present). ISPs are (rightly I suppose) trying to use SPF to reduce SPAM
>>through their systems but they are, quite sensibly, blocking ensitre
>>domains such as Hotmail.com - the very same free domains that small users
>>such as myself rely on using.
>
> ISPs that are using SPF will not block your HOTMAIL-spoofed email (due to
> SPF), unless you have configured SPF for your domain, thus requesting that
> they do so.

[PDS] Unfortunately we have very limited control over our domain because it
is part of a "package" sold to small political organisation. In order to
keep costs, and support cock-ups, to a minimu, the supplier exerts very
tight control so I can't turn on/off/modify the SPF records. I suspect that
I probably push the envelope of what most people do with it which is when
the fun starts.

>
...snip...

> Technically, if your employer has blocked SMTP, it probably means they do
> not want you sending email from work. So using the Hotmail website may
> actually be circumventing their policies.
>

[PDS] It's not the sending, rather its the downloading of potentially virus
ridden e-mail that they are concerned with. Of course anti-virus SHOULD
stop this but we all know that virus keys are sometimes just a fraction
behind the virus :-(.

> Secondly, your ISP (or your domain's mail server) probably also has
> webmail functionality. In which case, you could send mail directly from
> your domain and not need hotmail.
>

[PDS] Sadly they don't - see the comments above about costs etc.

> Thirdly, your ISP (or your domain's mail server) should have port 587 open
> for relay mail authentication. Port 587 is used for sending/relaying mail
> to/through a mail server using authenticated sessions.
>

[PDS] This they do seem to have and I'm investigating this route. Might
give me what I need.

> Southwestern Bell (and AOL I believe) block port 25 going out of their
> network, but they do not block port 587. So my customers are unable to use
> outlook to send mail through my server on port 25, but they can easily
> change that to port 587 and send mail successfully.
>
> SPF does not prevent you from using Hotmail, and there are probably much
> better (more professional) methods available to you than Hotmail.
>

[PDS] Possibly but using Windows Live etc. gives me a far quicker way to
send e-mails that normal web access and when you're doing something "in your
lunch hour", time is aluxury I don't have ;-).

>
> As for specific user exceptions, I would recommend looking into Domain
> Keys as yet another contribution to reducing spam.
>

[PDS] Thanks - never heard of them but I'll look them up.

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

Re: SPF and usernames (fwd) [ In reply to ]

vesely at tana

Jul 13, 2009, 8:44 AM

Post #5 of 5 (2759 views)

Permalink

Paul D.Smith wrote:
> [PDS] Unfortunately we have very limited control over our domain because
> it is part of a "package" sold to small political organisation. In
> order to keep costs, and support cock-ups, to a minimu, the supplier
> exerts very tight control so I can't turn on/off/modify the SPF
> records. I suspect that I probably push the envelope of what most
> people do with it which is when the fun starts.

Can you produce an actual message sent from an hotmail account,
however [mis]configured, that bounced because of SPF checking?

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com