SPF-enabled spam domains

Among the many anti-spam measures on my mail server – which help me reject 5000 spam attempts per day – is SPF. SPF allows domain name owners to specify which mail servers are allowed to send its mail. That makes it an excellent way to detect address forgeries, a favorite spammer tool.

One of the early questions raised about SPF was: won’t spammers just buy their own domains and set up their own SPF records that say it’s all OK? You can read the answer in the SPF FAQ, but the short version is: Yes, they will, but it won’t give them a free pass.

That’s because if spammers register a domain, publish SPF records for it, and send spam, they’ve identified that domain as one intended to be used for spam. Very good blacklist fodder.

With that in mind, here’s a list of about 50 domain names that have recently been used to send me spam. All of these have published SPF records, and all the spam I received was from servers approved by those SPF records.

In other words, as far as I can tell, these are domains that exist primarily, if not purely, to send spam.

Update – Here are the latest as of 2009-07-24: alg.com barrewardonline.com blueheavenbooks.com boudy.com eautocentral.com export2000.ro outpost.mm302.com qeentreeforlife.com ronaldvnash.com sistemas.com.ar smartserv.net solorpowernowme.com spig-int.com synergynetfour.com topproducerhelp.com truehouseinfo.com truelifeproducts.com unafraidrewardonline.com weathersearchontheweb.com

If for some reason a perfectly innocent non-spammy domain of yours has made it into this list, please let me know. (You might have to use my contact form, since I’ve already blacklisted all these domains!)

Fazal Majid commented :

SPF never claimed to stop spam, but it prevents impersonation of innocent domains by spammers. Establishing a trust metric for domains becomes an exercise left to readers.

Unfortunately too few domains implement SPF, those few who do usually leave too permissive settings, and the SPF spec itself has overly flexible declaration mechanisms that can turn a SPF verification attempt into 70 or more DNS packets going back and forth.