No Such Weblog

SMTP SPF: Senders Permitted From is a spam-avoiding proposal that looks like it might be adopted widely; it gives senders of e-mail a way to describe through DNS records what their messages look like and where they come from. E-Mails that don't match the description can then be discarded.

The proposal is likely to be adopted widely because it creates interesting incentives: If significant e-mail receivers apply SPF checks where available (and don't require senders to use SPF), and require existing sender domain names, this creates incentives for spammers to abuse non-SPF-enabled domain names. This will be painful for the holders and users of these domains, who in turn have strong incentives to publish SPF records. The same incentives apply for SPF records that are so loose that they are ineffective, or almost ineffective.

Later: Steve Bellovin (on IP) has a number of problems with the scheme.

I'm unimpressed by the privacy offered by .name WHOIS: The "detailed WHOIS" service which, according to the TLD agreement, is supposed to be password protected is the default service for port 43 queries, and is available from the web form without giving a password.

But then again, these guys might have better things to do.

Updated WHOIS data element chart including .name here.

A reader from PIR writes to note that the whois data element chart is wrong about the thick .org whois service. In August 2003, the .org registry WHOIS appendix was changed to be consistent with the data elements that registrars need to publish: The Registry Operator will not be required to post Whois Output Fields that are not required for posting in the Registrar Accreditation Agreement.

Updated data element chart here.