SPF: Penguins Can Eat Phishes, Too - Page 2

Continued From Page 1

Warnings

This is all still experimental, though many large networks are using it successfully. Your MTA will probably need to be patched to support SPF. Don't do this on a production system until you've worked out the kinks on a test system.

Writing The SPF DNS Entry

This part is easy, just use this is nice wizard. A tinydns entry looks like this:

'forgemenot.net:v=spf1 a mx ptr -all:3600
'*.mail1.psmtp.com:v=spf1 a -all:3600
'mail.forgemenot.net:v=spf1 a -all:3600
'forgemenot.net.mail1.psmtp.com:v=spf1 a -all:3600
'forgemenot.net.mail2.psmtp.com:v=spf1 a -all:3600

The wizard also spits out usable BIND entries. Click the "Explain" button to learn what everything means.

SASL/SMTP Auth

It doesn't make much sense to implement SPF without also requiring users to authenticate to your SMTP server. Most folks use Cyrus SASL. Here are some pointers for the different MTAs:

• Postfix SMTP AUTH (and TLS) HOWTO
• Sendmail-SMTP-AUTH-TLS-Howto
• Exim SMTP authentication
• SMTP authentication for Qmail

Enabling SPF Over Forwarding

SPF is fairly simple to implement if you're not using forwarding. But if you are, it breaks all to heck. Suppose you are forwarding through a smarthost, or maybe you host several domains that are forwarded through a single domain. Any time you forward mail from one domain to another, you'll need to use SRS, Sender Rewriting Scheme. Again this requires patching your MTA. Visit the SRS home page for downloads and documentation.

Testing SPF

Visit the tools page. There are links to several test pages.

Registering Your SPFed Domain

A nice final step is to register your domain at the SPFtools registration page. This lets the fine folks who are developing and supporting SPF know how many admins are deploying it.

SPF/SRS promises to be an effective anti-spam tool. It's lightweight and low-maintenance, so you won't have to babysit it, or make choices between security and performance.

Resources

• Sender Policy Framework
• Sender Rewriting Scheme
• Rules of Spam
• Tinydns