Re: [Asrg] misconception in SPF

Martijn Grooten <martijn.grooten@virusbtn.com> Mon, 10 December 2012 17:32 UTC

Return-Path: <martijn.grooten@virusbtn.com>
X-Original-To: asrg@ietfa.amsl.com
Delivered-To: asrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4574821F8563 for <asrg@ietfa.amsl.com>; Mon, 10 Dec 2012 09:32:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.289
X-Spam-Level:
X-Spam-Status: No, score=-10.289 tagged_above=-999 required=5 tests=[AWL=0.310, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ud4csQnwn7QO for <asrg@ietfa.amsl.com>; Mon, 10 Dec 2012 09:32:52 -0800 (PST)
Received: from mx5.sophos.com (mx5.sophos.com [195.171.192.175]) by ietfa.amsl.com (Postfix) with ESMTP id 86A2421F84CE for <asrg@irtf.org>; Mon, 10 Dec 2012 09:32:51 -0800 (PST)
Received: from mx5.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 02924540C69 for <asrg@irtf.org>; Mon, 10 Dec 2012 17:32:50 +0000 (GMT)
Received: from abn-exch1b.green.sophos (unknown [10.100.70.62]) by mx5.sophos.com (Postfix) with ESMTPS id C9D29540C60 for <asrg@irtf.org>; Mon, 10 Dec 2012 17:32:49 +0000 (GMT)
Received: from ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d]) by abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352%17]) with mapi id 14.02.0247.003; Mon, 10 Dec 2012 17:32:49 +0000
From: Martijn Grooten <martijn.grooten@virusbtn.com>
To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
Thread-Topic: [Asrg] misconception in SPF
Thread-Index: AQHN0+ufsqH0dJXpZk22wCV06nTFZ5gMNOaAgAASggCAALs6AIADkeEAgABtQPSAACMogIAAfLtKgAAmAwCAAClNo4AANEKAgAARtQCAAApSAIAABrkAgAAC+7M=
Date: Mon, 10 Dec 2012 17:32:48 +0000
Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20AD08F6@ABN-EXCH1A.green.sophos>
References: <20121206212116.10328.qmail@joyce.lan> <50C1A95A.5000001@pscs.co.uk> <50C4A7F8.3010201@dcrocker.net> <CAFdugamTbTirVV2zXKOmc9oTaCS+QiTemhT=jvYJnHYscHQK7g@mail.gmail.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACE6D0@ABN-EXCH1A.green.sophos> <20121209213307.D90C12429B@panix5.panix.com> <CAFduganBR_E-ui-3Xbic6F7qSmg1-Q+ideXLvb+1isLz8OF0Nw@mail.gmail.com> <0D79787962F6AE4B84B2CC41FC957D0B20ACFFE1@ABN-EXCH1A.green.sophos> <50C5A9A0.105@pscs.co.uk> <0D79787962F6AE4B84B2CC41FC957D0B20AD01B2@ABN-EXCH1A.green.sophos> <20121210145627.GA21217@gsp.org> <CAFdugakdqoN7S2YuWEVHo_YaOZJTPKt1w7tdcn8oasB=gb+qcg@mail.gmail.com> <50C60F9E.1060202@mustelids.ca>, <CAFdugakaY6Lh_5HR8xN7YqrimO9nM72mpxtLwE7T0CpKFu75tA@mail.gmail.com>
In-Reply-To: <CAFdugakaY6Lh_5HR8xN7YqrimO9nM72mpxtLwE7T0CpKFu75tA@mail.gmail.com>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.100.64.11]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [Asrg] misconception in SPF
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Dec 2012 17:32:53 -0000

> so you can forge emails as if they come from www.google.com even if
> there exists an SPF record for google.com !

You can also put go0gle[dot]com or googgle[dot]com in the envelope as neither have an SPF record.

Heck, you can even use google.com, the SPF record of which only tells the receiving MTA that it probably wasn't Google who sent the email, for it uses ~all rather than -all. And even if it did use -all, it doesn't necessarily mean that the email wouldn't get delivered as not all spam filters/MTAs block SPF fails.

So the 'problem' you've stated is ONE OF MANY WAYS in which a forged email can avoid being blocked by ONE OF MANY TESTS that is applied by SOME MTAs. Incidentally, it is ONE OF MANY WAYS that could confuse an end user who is looking at something most of us agree they shouldn't be looking in the first place and that BARELY ANY END USER looks at.

Unless you can finally come up with actual evidence that such emails are a) more likely to be delivered than other emails claiming to come from the target domain AND b) are more likely to be taken for real by the average end user, I think we're wasting our time here.

Martijn.

________________________________

Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England.
Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.