I have a question for anyone that has used SPF in their DNS and email
configuration on campus. (Stephen Bogdanski raised the issue May 2007)
Sender Policy Framework, formerly Sender Permitted From, is indirectly
supported by Exchange Server 2003 Service Pack 2. Exchange 2003
supports the Sender ID Framework specified by Microsoft which has as one
of its steps a lookup of the SPF entry in DNS for the domain of the
sending server. (note that Microsoft created conflicts and controversy
by linking Sender ID to SPF).
At KBS we are using Imail from Ipswitch which supports SPF directly, but
I know many departments on campus are using Exchange servers.
We have many users that configure their email clients to retrieve mail
from mail.msu.edu and send mail out through mail.msu.edu, but they set
the From: as <user>@kbs.msu.edu. So, if we implement SPF for our
domain, we need to define an SPF record that permits mail.msu.edu hosts
has the sending host. A large percentage of the spam that we receive is
from our own addresses, which unfortunately have been posted on an
externally accessible web page for many years. So, we can greatly
improve identification of spam by implementing SPF for our own domain.
SPF has been enabled on our email server for several years, and it has
not been well used, and it has not been a problem because we simply mark
the headers. It could be well used if we implement it for our own
domain (spam tagging only at the server) and then create filters in
email clients that check for @kbs.msu.edu in the From header and
X-IMAIL-SPAM-SPF in the header section.
I found detailed infomation about SPF and tools for testing it at
http://www.openspf.org including information about Sender Rewriting
Scheme (SRS, which was mentioned by Ed Kryda in May 2007). The issue
with SRS is that the FROM: address is compared to the last smtp host
through which the email msg was sent out. In the case of a user sending
the msg through mail.msu.edu with a From address of <user>@kbs.msu.edu,
the From address has already been rewritten.
I have tested (briefly) the following SPF entry for DNS which is
recorded as a TXT entry for kbs.msu.edu in our Windows Server 2003 DNS
server which is not able to create an SPF record:
v=spf1 mx ip4:35.9.75.19/24 -all
The "mx" mechanism declares that the ip addresses associated with MX
records for kbs.msu.edu are legitimate hosts for sending kbs.msu.edu
mail. And the ip4 mechanism (note the absence of the letter v) declares
ipv4 addresses that are also legitimate hosts. "-all" declares that all
other hosts are not legitimate (?all returns a status of NEUTRAL like
what an external host would be assigned if the domain had no SPF record).
This SPF record supports the case where a KBS user sends a msg through
mail.msu.edu to a user at kbs.msu.edu or mail.msu.edu, and to a user
that forwards their mail in one hop to MSU departmental server. If the
mail is forwarded to a departmental server, and forwarded again (i.e. a
second hop) to another account inside or outside MSU, then the SPF will
not match without SRS rewriting the From: address. If the msg is
forwarded from msu to gmail, and forwarded again, it will be the same
problem without SRS.
Therefore, two caveats to implementing SPF for our domain are that we
need to limit the set of hosts through which a user can send mail with
@kbs.msu.edu in the From header, and that recipients of our mail can
cause our mail to be marked with an SPF failure if they forward it in
two hops or more through non-kbs-non-mail.msu.edu servers.
Has anyone else done some testing?
Has anyone found a better way to declare the mail.msu.edu servers?
Would a:mail.msu.edu/24 work without a performance hit? (if there is
only one A record to look up and apply the /24 mask to, it seems like it
will be fast to me) Has anyone convinced the MSU mail team to create a
TXT v=spf1 record for the host _spf.msu.edu (referred to as a subdomain
on the openspf.org site) which can be referenced as follows:
v=spf1 mx include:_spf.msu.edu -all
I used one of the Kitterman tools linked on the openspf.org site to
check and did not find any SPF or _spf entries for msu.edu.
Note that some servers do not permit mail sent through them with a From
address that is not part of their domain. For example, I tried to test
my SPF configuration by sending a msg through smtp.att.yahoo.com with a
From address of <user>@kbs.msu.edu, and the SMTP server rejected my
message and I received a popup in Thunderbird telling me of the
rejection with a specific reference to the From address. I respect this
restriction, and if I really wanted to influence someone to reply to a
different address I would use the Reply-to header, which many mail
clients respect, but some do not allow you to specify the Reply-to in
your outgoing mail.
-Stefan
KBS Computer Services Helpdesk:
[log in to unmask]
269-671-2100 (from campus 199-2100)
Stefan Ozminski
Computer Services
W.K. Kellogg Biological Station
Michigan State University
3700 E. Gull Lake Dr.
Hickory Corners, MI 49060
Phone: 269-671-4427 (from campus 199-4427)
[log in to unmask]
|
