Re: [Full-disclosure] Strange Emails -- What are they?

[Michael Holstein <michael.holstein@xxxxxxxxxxx>]

> What would really help is SPF, if you can manage it. That way you can 
> reject mail that claims to come from your domain but does not come from 
> your mail servers.  But this is all a bit OT, not really full disclosure.

Well, sort of. Too many domains do something like '~' or '?' instead of 
'-' like they should.

(dig -t txt $domain) :

AOL : ?all
Hotmail/MSN : ~all
Google : ~all

http://en.wikipedia.org/wiki/Sender_Policy_Framework

AOL's is perticularly ironic, considering they hard-hand other folks 
into publishing a SPF record to deliver to them, but publish a ?all (no 
policy) record themselves.

What you can do quite effectively though, is to consider SPF (to 
penalize) as one of several factors in something like SpamAssassin.

~Mike.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/