Sender Policy Framework (SPF) is an antispam measure designed to fight email address forgery. Using SPF, the Internet domain of an email sender can be authenticated for that sender, thereby discouraging spammers who routinely disguise the origin of their email--a practice known as email spoofing. Under this practice, spammers forge the email header so that the message appears to have originated from someone or somewhere else. Spammers often use spoofing in an attempt to get recipients to open, and possibly even respond to, their solicitations.
To combat email spoofing organizations are publishing SPF records for their own domains and then using SPF to distinguish forgeries from real email sent by other domains. Published SPF records include attributes that uniquely describe an organization's email, including authorized senders and mail server IP addresses. On the receiving end, organizations using SPF verify the authenticity of each sender's FROM email address by performing DNS queries (accessing the published SPF record) to confirm that the sending server is authorized to send mail on behalf of that address.
Most mail servers use SPF with SpamAssassin and use a scoring system to validate whether the message is likely spam, for example,
When the Sender SPF record passes, a negative spam score can be recorded to reduce the possibility of the message being marked as spam.
When the Sender SPF record fails, the spam score can be increased by 5 points to insure it's marked as spam.
When unable to verify an SPF record (soft-fail), the spam score can be increased slightly.
Additional information on how to configure SPF can be found at Open SPF:
http://www.openspf.org/
Is E-Mail Dead? Not So Fast!
1 week ago
