Re: Why SPF and DK are not being used

     --
Chris Drake wrote:
 > SpamAssassin is probably the most widespread filter
 > deployed, and it uses SPF for sure (probably DK too I
 > think).  The two most effective commercial solutions
 > (Brightmail and the other one - I forget it's name
 > right now) both feed from SPF information as well - so
 > even though you might *think* nobody's using SPF - in
 > reality - almost everyone is using it, as part of
 > their spam scoring systems.

Spam assassin (and probably the others) only nominally
uses DK and SPF.  SpamAssassin fails to utilize
authenticity information to identify originating domains
as known good or known bad.

In SpamAssassin, DK signatures have the same effect on a
mail's score whether signed by gmail, or signed by a
known spammers (not much effect at all).  Similarly for
compliance with SPF rules, though it is more complicated
for SPF rules.

Since it attaches no reputation to sites that prove
origin of their email, it gives legitimate sites no
reason to prove origin of their email - and it gives
spammer sites every reason to prove origin of their
email when they can

     --digsig
          James A. Donald
      6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG
      o4Pmf5hC+o4QP7PXzjMFQKwxMaWOwgdMqhVhxNB6
      4kLS4/y5EeZ8ohSPvFeh7TSBytW0tzQ0v+zd3OUwn

Received on Saturday, 17 June 2006 21:43:11 UTC