[Mimedefang] Deadline for SPF records

[Cor Bosman]

> Let's say that the SPF record for futuresource.com says that the
> allowed relay is mail.futuresource.com. This means that mail coming
> from mail.futuresource.com (as the relay) is legitimate and that all
> other mail is likely to be forged. Now, why would
> mail.futuresource.com allow someone to spoof the envelope sender from
> its own domain? For example, my mail server has been configured to
> check all envelope sender addresses which are from local domains.
> Therefore, I can't send a message with an envelope sender of
> fakeusername at wiktel.com. If SPF was widely adopted, these two
> measures would effectively stop forgery of all wiktel.com addresses.

Do you also check notfakeusername at hotmail.com? What about people sending
email themselves but receiving through your MX? What about people that
have access through another company with one of your domains but they
arent using your mailserver with authentication? What about receiving
email from notfakeuser at aol.com from a mailserver that isnt listed as
being from AOL, to a valid customer of yours?

Cor