Roger B.A. Klorese <rog...@queernet.org> wrote:

But it *could* be. You can set the following SPF record for workdomain.com (if
Earthlink has their own SPF set up correctly):

v=spf1 [...] include:earthlink.net -all

or (if Earthlink uses their incoming MXes as outgoing MXes as well):

v=spf1 [...] mx:earthlink.net -all

or even (otherwise):

v=spf1 [...] a:smtp.earthlink.net -all

Then you can send via Earthlink, with only minimally loosened SPF protection
(theoretically, any Earthlink user could forge his mails as coming from
workdomain.com). qed.

Yahoo's scheme has the advantage that the owner of workdomain.com doesn't have
to open his domain to forgery from other domains (like in the example above).
But as soon as a user @workdomain.com is forced to send through a 3rd party SMTP
relay (like in the example above), either the user or that 3rd party would need
access to the workdomain.com private key to properly sign the sent messages.

So essentially, the difference in this regard between SPF and the Yahoo scheme
is that with SPF, the 3rd party must be trusted, while with the Yahoo scheme,
the 3rd party OR the user @workdomain.com must be trusted. I.e., with SPF,
trust cannot be delegated to the user.

Did I get anything wrong?