Is SPF a good thing to use for Email

Ianf1

Ianf1

Expert Member
Joined
Aug 5, 2007
Messages
1,970
Reaction score
201
Location
Johannesburg
Hi
I am an interested user but don't know a lot about hosting.
For Email authentication I have turned off DKIM in my cpanel settings. The SPF is still on. Lately I don't get some emails and the sender then sends it to a gmail address. When I asked the hosting company they said
It appears the domain xxxxdingcc.co.za has been incorrectly configured for sending emails. They have explicitly told our email server to deny emails that were not sent from the IP address: x.x.x.x
Click to expand...
They have allowed it now.

Would it not be better to disable spf and let NOD32 filter all incoming mail. As most small companies have no idea about setting email on the servers. The settings then chosen by the hosting company can stop the flow of emails for new business.
 
Assuming xxxxdingcc.co.za is the sender domain and not the recipient domain (i.e. your domain as far as I can see), your filtering based on SPF would only cause the mail not to arrive if the sender domain has their set up incorrectly. I can't really tell without seeing their records.

One problem I see with SPF is that mail software often labels it as an "anti-spam" technology. For example, Plesk allows you to turn on "SPF Spam Protection" or something like that. SPF is *NOT* anti-spam - it has nothing whatsoever to do with spam. It is an anti-forgery technology. The same goes for domainkeys/DKIM - they're designed to verify that a mail actually comes from the domain it claims to come from.

Either ways, SPF has its reliability problems, to the point that systems like spamassassin (which uses a points based system and assigns different weight to different transgressions) only assign only 0.001 for SPF, i.e.:

SPF_PASS=-0.001
SPF_FAIL=0.001

That's out of a total of 6.31 needed (by default) to mark something as spam.

DKIM is a much better system. It doesn't matter what path the mail follows to get to the recipient, if the signature is correct, you're good. And if the signature is wrong, you know something is wrong.
 
And SPF + DKIM is integrated into DMARC where you can define the policy for both and the reporting email address for failures
 
Hi Koffiejunkie,
This was the sender domain that was blocked. I did turn off spam assassin as well. I have started to receive a few spam emails from chinese companies which land up in junk email as well.
Nkawit I don't see any dmarc option on the cpanel page is this an additional service?
 
Ianf1 said:
Hi Koffiejunkie,
This was the sender domain that was blocked. I did turn off spam assassin as well. I have started to receive a few spam emails from chinese companies which land up in junk email as well.
Nkawit I don't see any dmarc option on the cpanel page is this an additional service?
Click to expand...

Oh, sorry. I just wanted to mention that DMARC is used to set the policy of receiving servers when they encounter DKIM and SPF.

I don't believe its something you can set in cPanel by a click of a button, you would need access to the advanced DNS editor. If you have any trouble setting it up I'm sure your hosting provider will be more than happy to assist, just tell them what you want added :)
 
Ianf1 said:
Hi Koffiejunkie,
This was the sender domain that was blocked. I did turn off spam assassin as well
Click to expand...

You don't need to turn off spamassasin. The SPF scores I quoted are from Spamassassin. Just don't filter mail based on SPF.
 
SPF is a good thing. It allows mail servers to check if the sender is really allowed to send via that domain, which makes spoofing emails from your account to someone else to spread virusses, less likely
 
I have SPF configured for our domain. No problems experienced and as far as i know it's meant to protect your domain from email spoofing by verifying that the sender Ip address is an authorised IP for the domain
 
I have left the spf configured and seem to get email now. But our main Telkom line is down, so customers can't phone in.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X