Subject: Re: [spfbis] New Issue: Requirement to check mail from

From: "G.W. Haywood" <[email-masked]>
Date: Thu, 23 Feb 2012 07:50:03 +0000 (GMT)

Hi there,

On Mon, 20 Feb 2012, Scott Kitterman wrote:

> Paragraph 2.2, The MAIL FROM Identity, includes this statement:
>
>    SPF clients MUST check the "MAIL FROM" identity.  SPF clients check
>    the "MAIL FROM" identity by applying the check_host() function to the
>    "MAIL FROM" identity as the <sender>.
> 
> There are applications that check HELO first and can reach a final conclusion 
> about message disposition based on that check.  In such a case, the Mail From 
> check is a waste of resources.
> 
> I'm recommend changing this to either:
> 
> SPF clients MUST check the "MAIL FROM" identity unless a HELO check has 
> already produced a definititive policy result. ...

I'd question the wording "definititive policy result" (and not just
because of the spelling. :)

The word 'policy' in this case might be taken to mean "SPF policy",
yet a rejection at the HELO stage can be made for a number of reasons,
some of which require very little processing and no DNS lookups.

Most of the garbage HELOs we see result in immediate rejection before
an SPF check has been made, so in a sense it is a 'policy' decision e.g.
because we don't accept mail from home routers, but it isn't SPF policy.

--

73,
Ged.