SPF: Penguins Can Eat Phishes, Too - Page 2

 By Carla Schroder
Page 2 of 2   |  Back to Page 1
Print Article

Continued From Page 1


This is all still experimental, though many large networks are using it successfully. Your MTA will probably need to be patched to support SPF. Don't do this on a production system until you've worked out the kinks on a test system.

Writing The SPF DNS Entry

This part is easy, just use this is nice wizard. A tinydns entry looks like this:

'forgemenot.net:v=spf1 a mx ptr -all:3600
'*.mail1.psmtp.com:v=spf1 a -all:3600
'mail.forgemenot.net:v=spf1 a -all:3600
'forgemenot.net.mail1.psmtp.com:v=spf1 a -all:3600
'forgemenot.net.mail2.psmtp.com:v=spf1 a -all:3600

The wizard also spits out usable BIND entries. Click the "Explain" button to learn what everything means.


It doesn't make much sense to implement SPF without also requiring users to authenticate to your SMTP server. Most folks use Cyrus SASL. Here are some pointers for the different MTAs:

Enabling SPF Over Forwarding

SPF is fairly simple to implement if you're not using forwarding. But if you are, it breaks all to heck. Suppose you are forwarding through a smarthost, or maybe you host several domains that are forwarded through a single domain. Any time you forward mail from one domain to another, you'll need to use SRS, Sender Rewriting Scheme. Again this requires patching your MTA. Visit the SRS home page for downloads and documentation.

Testing SPF

Visit the tools page. There are links to several test pages.

Registering Your SPFed Domain

A nice final step is to register your domain at the SPFtools registration page. This lets the fine folks who are developing and supporting SPF know how many admins are deploying it.

SPF/SRS promises to be an effective anti-spam tool. It's lightweight and low-maintenance, so you won't have to babysit it, or make choices between security and performance.


This article was originally published on Sep 29, 2004
Get the Latest Scoop with Networking Update Newsletter