Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft to Deploy SPF for Hotmail Users

Posted by michael on from the ever-so-slightly-less-spam dept.

wayne writes "In a show of just how much Microsoft wants to put an end to email forgery, Hotmail, MSN and Microsoft.com will start enforcing Sender ID checks by Oct 1. In late May, MicroSoft announced that they would be adopting the Open Source SPF anti-forgery system (with a slight modification to make it Sender ID) and they have been working together with the IETF MARID working group to help create an RFC to define the Sender ID standard. Already tens of thousands of domain owners, such as AOL, Earthlink, and Gmail, have published SPF records, and thousands of systems are already checking SPF records. Publishing SPF records is easy, as is checking SPF records."

2 of 562 comments (clear)

  1. Making sure I see my role in this... by E1ven · · Score: 5, Interesting

    Ok.. Let me make sure I understand this correctly..

    I maintain a few domains, such as a Sq7.org, from which I send e-mail.. I send it from home, from my girlfriends house, from wherever I happen to be.. But I send it by connecting through the sq7.org server, and forwarding mail through there.

    The way I understand SPF, I just need to publish that the IP sq7.org runs on is authorized to send Sq7.org's mail, and NOT the IP for my home, office, etc, since I don't send directly from the local computer.

    If I did send directly from the local computer, without going through the external server, I'd need to add my local IP to the SQ7.org DNS records.

    As it is, though, I'll need to avoid using my ISP's SMTP servers if mine go down, or add them to the domain.

    Am I understanding this right?

    -Colin

    --
    Colin Davis
    1. Re:Making sure I see my role in this... by mshultz · · Score: 5, Interesting

      Yeah, I was wondering about this too--- particularly how this is going to work with things like universities. Where I just graduated from, you're only allowed to use their SMTP server if you are either on campus, use the VPN, or are using authentication over SSL from wherever. For everyone off campus, you are expected to use your ISP's SMTP server.... and often, you'd have to anyway, with ISP's blocking outgoing port 25 these days. So how then would a university, for example, implement SPF with people using whatever.edu 'From' addresses, but going through thousands of different ISP-owned SMTP servers?

      Surely there's a better solution than to have people change their 'From' address based on who's providing their internet connection at that moment (a real challenge for wireless hotspot users.....), and just keep the Reply-To header constant.

      Maybe I understand this wrong-- just wondering how it's all going to work.