Subject: [spfbis] Policies (was: 14: RFC 4408: local-part macro prep for deprecation)

From: Arthur Thisell <[email-masked]>
Date: Tue, 20 Mar 2012 07:57:05 -0700 (PDT)

> The difference is that Best-Guess SPF imposes a record where there is none, > which is a complete policy fabrication.

There is some easy confusion here.

SPF stands for Sender Policy Framework, but it isn't really a sender policy, rather it is a domain owner's policy.  Its use has never really been extended into other policy areas the way Meng and Micrsoft (a la positional keywords in senderid) envisioned, so the name is somewhat misleading.

The SPF "best guess", isn't really a fabrication of a domain owner's policy, it is an email receiver policy.  It is perfectly ok for a receiver to implement any policy they want, including requiring IP addresses to be prime numbers or requiring at least one vowel in the sender's domain name.  I suppose that "best guess", like FCrDNS, does vaguely authenticate stuff, but if we put it in the Authentication-Results header, it needs to be clear that it is a receiver's policy.   In any case, I don't think "best guess" usage is really a subject that belongs here.