Re: [spfbis] A standards track document defining SPF

[Andrew Sullivan <[e-mail]>]

No hat.

On Wed, Jul 18, 2012 at 11:53:09PM -0400, Hector Santos wrote:

> First, more and more SMTP servers are already requiring a PTR for
> the connecting client, so this result will already be in server's
> DNS resolver cache by the time SPF is checked and processed.

Whoa. 

Some time ago, DNSOP failed to reach consensus on a draft, which died
as draft-ietf-dnsop-reverse-mapping-considerations-06.  There were
plenty of things wrong with that draft (not least of which was the way
it became a soggy blancmange in an attempt to address everyone's
objections), but one distinction it made that is useful is between
_existing_ reverse mapping data and _matching_ reverse mapping data.

In my experience, most SMTP servers that are checking for a reverse
mapping are in fact checking that there is a reverse mapping entry at
all.  They are checking for existing reverse data.

Many spam-scoring systems also check for match, but a
forward-reverse match is _much_ harder to ensure, and that can lead to
a high false positive rate.

The ptr mechansim in 4408 checks for matching reverse data.  This is
both a higher bar to leap, and more expensive to process, than a mere
existence check.

Best regards,

A

-- 
Andrew Sullivan
[e-mail]