On Wed, 31 Oct 2007, Arturo 'Buanzo' Busleiman wrote:

Since you asked: A consultant comes to my site and needs to send an email out. I run transparent port 25 redirection on the firewall to a local smart-host that allows sending from the local IPs. This is mainly for logging purposes - anybody who has ever had to allow a lot of windows machines on their network will have suffered zombies spamming and getting their IP address blacklisted as a consequences. With SMTP logs in one place for all outbound mail, at least you can identify what internal address it came from and thus what machine is/was spamming.

Anyway, the said consultant sends an email from his laptop, and it ends up sending from my local, redirected SMTP server. His address would be on a domain with an SPF pointing to his network, not mine, yet valid email was sent with an SPF record that doesn't match.

Yes, I know this could be worked around using a VPN. But it is an obvious example of having to go further out of one's way to work around something that was fixed without being broken in the first place. It's not the way forward.

Gordan