sondra.kinsey's questions

CPanel gives me options about what MIME content types to compress with Apache's mod_deflate, as shown below.

Are there disadvantages to having a long list of MIME types (eg. slower server response)? In other words, is there any reason I shouldn't find or create a very long list of every imaginable uncompressed filetype?

Obviously, it is best not to compress filetypes that are already compressed, eg. videos, .docx. Are there other considerations for what should be included or not included in this mod_deflate types list?

Question

What are the advantages and disadvantages of using Fail vs. a SoftFail in my SPF record?

What I found on the topic

Back in 2007, knowledgeable-seeming folks seem to have said SoftFail was just for testing and encouraged changing it to reject once you have everything setup properly (here and here)

This forum post calls SoftFail "wrongly configured", but then says that Google uses it. I trust Google for best practices more than a random forum poster! I checked and indeed, Gmail uses ~all (a SoftFail) in their SPF record.

On the sender end of things, email deliverability experts seem to encourage using SoftFail:

Fail "is more aggressive [than SoftFail] and is known to create more issues than it solves (we don’t recommend it)."

—Postmark SPF Guide

That's rather vague.

"I generally recommend publishing ~all records for my clients. There’s not a huge benefit to publishing -all and sometimes mail gets forwarded around. The one time I recommend a -all record is when a domain is getting forged into spam. Domain forgery can cause a lot of bounces. The amount of bounces can be bad enough to take down a mail server, particularly those with a small userbase. Many ISPs will check SPF before sending back a bounce and so a -all record can decrease the amount of blowback the domain owner has to deal with."

—Email deliverability consultants Word to the Wise

Yet how will a webmaster know if there is a substantial amount of domain forgery going on? Isn't a best practice to prepare for the worst and anticipate forgery in advance?

On the receiving end, Terry Zink, who works in enterprise spam filtering, offers a strong case for hard Fail to prevent phishing emails from going through, and says most people use SoftFail because organizations are more afraid of emails being lost than about forged emails. What is the likelihood that a forged phishing email which SPF SoftFails actually gets to someone's inbox?