Change of policy, SPF bypass for whitelisted senders
by Andrew Macpherson on May.25, 2010, under E-Mail hosting, SPF the Sender Policy Framework
Sometimes you have to give up, and take the hit of extra SPAM. For me personally, one of the more valuable features of ASSP’s SPF checks was to apply the check to incoming addresses that are otherwise whitelisted, so that no-one can hijack a genuine contact’s email address to send one spam.
But there is always the wilfully ignorant customer of one’s customers who refuses to believe that their IT provider has not authorised the way they are sending mail. “Lots of other places receive my mail” — well yes but they’re not checking, “Well it must be your fault, and no I can’t talk to my IT department, you fix it” — phone slams down.
When the person who will not listen is controlling a significant spend some form of smiling compliance is forced.
We still have a list of domains where we force SPF checks, and let’s say a big “THANK YOU’ to HSBC, PayPal and RBS who actually care enough for their customers to protect them from phishing with SPF.
In contrast one ought to hold up to ridicule Barclays, NatWest, Santander, Bank of Scotland, Lloyds, Halifax etc who (as of today) still leave their customers open to attack.
