Sender Policy Framework
-
I have a dedicated server at ServerBeach and run MailEnable Professional ... I use it for about a dozen domains ... Lately I've been getting a TON of bounce backs, and such from spam forging my domain in the "From", "Return-Path", etc. (Over 1,000 a day). And I'm trying to figure out what to do about this as it has become almost unmanageable. I'm sure my SMTP server is secured. Here's my question ... Does anyone have any feedback in regards to enabling SPF? Do you think this would this be a good idea or not? Are there drawbacks to it? I can't afford to lose mail from legitimate clients, however if I lost one or two it probably wouldn't matter that much (I hope). Anyway, any thoughts on whether I should enable SPF or not would be greatly appreciated ... Thanks!
-
I have a dedicated server at ServerBeach and run MailEnable Professional ... I use it for about a dozen domains ... Lately I've been getting a TON of bounce backs, and such from spam forging my domain in the "From", "Return-Path", etc. (Over 1,000 a day). And I'm trying to figure out what to do about this as it has become almost unmanageable. I'm sure my SMTP server is secured. Here's my question ... Does anyone have any feedback in regards to enabling SPF? Do you think this would this be a good idea or not? Are there drawbacks to it? I can't afford to lose mail from legitimate clients, however if I lost one or two it probably wouldn't matter that much (I hope). Anyway, any thoughts on whether I should enable SPF or not would be greatly appreciated ... Thanks!
You definitely need your own SPF record so that other mail servers can recognise legitimate mail from your domains. Turning on SPF checking for received mail in ME Professional is also a very good idea however, do not simply delete mail when the SPF check fails, make sure it goes into quarantine so you can get a chance to check if it is legitimate or not. Some mail servers do not have properly configured SPF records so legitimate mail can fail SPF very easily. As for the bounce backs, if the mail server receiving the emails with the forged addresses does not implement SPF checking then there is nothing that can be done. Cheers, Brett