Hacker News Reader

I started checking SPF records on my mail server. All spam that makes it through the other checks also has correct SPF records. Presumably if spammers control DNS for a bunch of crappy domains they can dynamically add the zombie machines to the SPF records on the fly and just get on with their day. Very disheartening.

View on HN

SPF isn't really an anti-spam tool, it's just a way to verify that the sender domain isn't being spoofed. For instance, it stops spammers from sending mail with a paypal.com email address.

Exactly. Spammers can use any email address they'd like and Verizon simply passes it on to the recipient. A spammer used one of my domains (with valid SPF records added years ago) and texted thousands of Verizon customers. I intercepted all replies to the texts with a catch-all email and found hundreds of complaints including several death threats and a father who told me his young daughter received a porn text from my domain. After 3-4 days, their spam filter finally kicked in. My domain was blacklisted and I basically had no control over it.

Reply on news.ycombinator.com