Terry Zink has found a spammer that had a valid SPF record and managed to get his advertisement into his field of attention. I don’t buy the “not that it helps” bit since it got as far as his blog ;) and after all anyone sending from this domain would get an SPF PASS when tested and would require further testing of its legitimacy and content.

I’ll get back to my point; This is not an “odd” thing!…

Schalk did a study some time ago on SPF but neglected to point out one important statistic that Terrys post reminded me about. Nearly 9% of the SPF records in his study were +all records. An SPF record of +all means anyone can send email for a domain, and the study covered what we term “domains in focus” (basically domains that we’ve seen used pretty recently and kept an eye on). We’ve kept an eye on this sort of thing for a long time since spammers were the first to adopt SPF for obvious reasons (+all loophole being the main one).

So for anyone that has got this far and doesn’t see the point yet… +all SPF records mean “I don’t care” :evil:

I firmly believe that not enough domain owners publish SPF records, so here is a quick guide to SPF for the-little-guy (All you big companies already have them right?).

Situation 1 - Your domain is hosted on a cpanel account (other $5/month hosting products are available) or your a single server company handling your own inbound mail :

"v=spf1 mx -all"

This SPF record says: Only my mail server can send mail for my domain.

Situation 2 - Mail is routed out (smarthosted) by your ISP:

"v=spf1 mx a:smtp.example.com -all"

This SPF record says: Only my mail server and the host smtp.example.com can send mail for my domain.
or

"v=spf1 mx ip4:172.16.25.25 -all"

This SPF record says: Only my mail server and the host with the IP address 172.16.25.25 can send mail for my domain.
or

"v=spf1 mx redirect:example.com -all"

This SPF record says: Only my mail server and any SPF host for example.com can send mail for my domain.

So there you go. That’s how you can help protect your domain from being forged by spammers. All we need to do now is have the rest of the world check them. Shoot anyone with a +all record type and convince any online auction and payment processing sites to make theirs less broken, so it actually works too (RFC 4408,10.1/6) ;-) .