发件人策略框架







本条目可参照英語維基百科相應條目来扩充。
若您熟悉来源语言和主题，请协助参考外语维基扩充条目。请勿直接提交机械翻译，也不要翻译不可靠、低品质内容。依版权协议，译文需在编辑摘要注明来源，或于讨论页顶部标记{{Translated page}}标签。


发件人策略框架（英语：Sender Policy Framework；簡稱SPF； RFC 4408）是一套电子邮件認證機制，可以確認電子郵件確實是由網域授權的郵件伺服器寄出，防止有人偽冒身份網路釣魚或寄出垃圾電郵。SPF允许管理员设定一个DNS TXT记录或SPF记录设定发送邮件服务器的IP范围，如有任何郵件並非從上述指明授權的IP地址寄出，則很可能該郵件並非確實由真正的寄件者寄出（郵件上聲稱的「寄件者」為假冒）。[1]




目录






  • 1 用途


  • 2 原理


  • 3 外部链接


  • 4 来源





用途


SPF 记录的用途是阻止垃圾邮件发件人发送假冒您的域中的“发件人”地址的电子邮件。收件人可以参考 SPF 记录来确定号称来自您的域的邮件是否来自授权邮件服务器。对于大多主流的邮件服务商，鉴别发送者的SPF记录有助于抵御垃圾邮件给接收者带来的骚扰。[2]



原理


SMTP協定本身沒有機制鑑別寄件人的真正身份，電子郵件的「寄件者」一欄可以填上任何名字，於是偽冒他人身份來網路釣魚或寄出垃圾郵件便相當容易，而真正來源卻不易追查。


SPF 记录允许域名管理员公佈所授權的邮件服务器IP地址，接收服务器会在收到邮件时验证发件人在 SMTP 会话中执行 MAIL FROM 命令时的邮件地址是否与域名 SPF 记录中所指定的源 IP 匹配，以判断是否为发件人域名伪造。


邮件接收方的收件服务器在接受到邮件后，首先检查域名的SPF记录，来确定发件人的IP地址是否被包含在SPF记录里面，如果在，就认为是一封來自於被授權伺服器的邮件，否则会认为是一封伪造的邮件並根據相關政策退回或放進收件人的雜件箱。[3]


Sender-policy-framework-spf-exchange-2.jpg


简单来说，SPF 记录其实就是一条有特殊语法的 TXT 记录，它由「匹配机制」和「修饰符」2 部分组成。「修饰符」通常只作为可选项，一般情况下 Exchange 管理员只会用到并处理包含「匹配机制」的 SPF 记录。[4]


SPF 记录的匹配机制主要用于定义和指定可由该域名发送邮件的主机，其定义方式包括：




  • all 匹配任何主机，它写在 SPF 记录最后以匹配在其前面所列出的主机。


  • ip4 匹配 IPv4 地址或网络范围。


  • ip6 匹配 IPv6 地址或网络范围。


  • a 匹配主机名或域名。


  • mx 匹配域名的 MX 记录，当出站与入站邮件为同一服务器时通常采用此种机制。


  • ptr 通过 DNS 反向记录来匹配发件人 IP 和域名，由于会增加 DNS 负载，一般不采用此种机制。


  • exists 只检查域是否在 DNS 中存在。


  • include 将发件人 IP 和 SPF 记录指向另一个域，这种匹配机制通常用于云服务，如 Exchange Online Protection。


SPF 记录的匹配机制会结合一些限定词来使用，以告诉服务器找到一条匹配记录时该怎么办。常见的限定词有：




  • + 放行，如果没有明确指定限定词，则为默认值。


  • – 硬拒绝，直接拒绝来自未经授权主机的邮件。


  • ~ 软拒绝，邮件可被接受，也可被标记为垃圾邮件。


  • ? 中性，不考虑邮件是否被接受。


SPF 记录会结合「匹配机制」和「限定词」使用，例如：在 SPF 记录的末尾处写有 -all 则表明在不匹配前面所列主机时，接收服务器需要将邮件全部拒绝。



外部链接



  • Sender Policy Framework项目网站

  • RFC 4408



来源




  1. ^ http://www.ietf.org/rfc/rfc4408.txt


  2. ^ https://support.google.com/a/answer/33786?hl=zh-Hans


  3. ^ http://service.exmail.qq.com/cgi-bin/help?subtype=1&&id=20012&&no=1000580


  4. ^ http://www.sysgeek.cn/sender-policy-framework-spf-exchange/




Comments

Post a Comment

Popular posts from this blog

Information security

Image
This article is part of a series on Information security Related security categories Internet security Cyberwarfare Computer security Mobile security Network security Threats Computer crime Vulnerability Eavesdropping Malware Spyware Ransomware Trojans Viruses Worms Rootkits Bootkits Keyloggers Screen scrapers Exploits Backdoors Logic bombs Payloads Denial of service Defenses Computer access control Application security Antivirus software Secure coding Secure by default Secure by design Secure operating systems Authentication Multi-factor authentication Authorization Data-centric security Encryption Firewall Intrusion detection system Mobile secure gateway Runtime application self-protection (RASP) v t e Information security , sometimes shortened to InfoSec , is the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information. Th...
Read more

Volkswagen Group MQB platform

Image
The Volkswagen Group MQB platform is the company's strategy for shared modular design construction of its transverse, front-engine, front-wheel-drive layout (optional front-engine, four-wheel-drive layout) automobiles. Volkswagen spent roughly $60bn [1] developing this new platform and the cars employing it. The platform underpins a wide range of cars from the supermini class to the mid size SUV class. MQB allows Volkswagen to assemble any of its cars based on this platform across all of its MQB ready factories. This allows the Volkswagen group flexibility to shift production as needed between its different factories. Beginning in 2012, Volkswagen Group marketed the strategy under the code name MQB , which stands for Modularer Querbaukasten , translating from German to "Modular Transversal Toolkit" or "Modular Transverse Matrix". [2] [3] MQB is one strategy within VW's overall MB (Modularer Baukasten or modular matrix) program which also includes th...
Read more

Daniel Guggenheim

Image
Daniel Guggenheim 1925 photo Born ( 1856-07-09 ) July 9, 1856 Philadelphia, Pennsylvania Died September 28, 1930 (1930-09-28) (aged 74) Port Washington, New York Alma mater Peirce College Known for Battle for control of ASARCO Daniel Guggenheim Medal Spouse(s) Florence Shloss Children Meyer Robert Guggenheim Harry Guggenheim Gladys Eleanor Guggenheim Parent(s) Meyer Guggenheim Barbara Guggenheim Daniel Guggenheim, 1910 Daniel Guggenheim (July 9, 1856 – September 28, 1930) was an American mining magnate and philanthropist, and a son of Meyer and Barbara Guggenheim. Contents 1 Biography 2 Personal life 2.1 Aviation 2.2 Alaska 3 See also 4 References 5 Further reading 6 External links Biography Born and raised in Philadelphia, Daniel Guggenheim was sent to Switzerland as a young man to study the Swiss lace and embroidery business, and to serve as a buyer for his father's import firm. The...
Read more