Part 1 of 2 parts
"Sender Permitted From," or SPF, is a new protocol that works in conjunction with existing e-mail protocols to insure that a person sending an e-mail on behalf of a given address has the right to do so.
SPF is basically a reverse MX record for Domain Name System (DNS). Normally, a domain publishes an MX record to tell the world what machines can receive e-mail for a given domain. SPF lets the same domain publish a record to tell the world what machines send mail from the domain. Computers that receive e-mail can then check incoming mail (during the POP3 conversation) against the SPF record to make sure the mail is indeed coming from the domain it's allegedly written from.
Using SPF can prevent messages from being sent illegally on behalf of another domain, and may in turn reduce the amount of e-mail with forged or misleading headers. Most spam is sent in this fashion, so SPF can be part of a multi-pronged attack against spam, including DNS blacklisting and Bayesian filtering.
By default, e-mail has a massive security hole: anyone can send e-mail claiming to be anyone. A user at isp.org could send e-mails claiming to be from rootbox.net. SPF is intended to close that hole over with a minimum of problems. Although SPF does break one piece of standard e-mail functionality—direct forwarding. I'll get into more detail on this in tomorrow's article.
SPF does not verify individual sender usernames. In other words, it does not perform a lookup to verify that the sender of the e-mail does in fact have a valid e-mail account at the originating domain. It only verifies that the e-mail being sent does in fact come from the domain in question.
SPF requires two things:
1. The sending domain must publish a reverse MX record.
2. The receiving domain must perform the reverse MX lookup on in-coming mail.
Participating in SPF is free and voluntary, and once installed it does not need to be maintained except in the sense that one's event sink filter or other SPF lookup system might need bug fixes.
The reverse MX record, once published, does not need to be changed. Usually any domain that is doing one will do the other. Implementing the first in a system running Windows 2000/2003 Server is easy enough, but having Microsoft Exchange perform an SPF lookup is not something Exchange can perform natively yet. But even if you can't implement SPF checks on your incoming e-mail, publishing an SPF record for your domain will prevent others from using your domain name illegitimately.
Part two. How to create the reverse MX record and how to add SPF support to Exchange. Click here
Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter. Check out site for his latest advice and musings on the world of Windows network administrators; please share your thoughts as well!
