I appreciate the explanation Bill. I won't be implementing SPF until it's aged a little and I am confident that I understand it aright.
The score of 35 and 10 look like the same domain; were they to mail hosts with different MX records? I assume that the 39 score is separate because of case-sensitivity in your reporting. And now to go into "SPF for Dummies" territory, the mailfroms were definitely spoofed, or in the normal course of events could have been mailing list or greeting card invitations that unwisely put in the "sender's" address in the mailfrom instead of their own? Andrew. -----Original Message----- From: Bill Landry [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 13, 2004 4:56 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SFP is catching on... ----- Original Message ----- From: "Colbeck, Andrew" <[EMAIL PROTECTED]> > Thanks for sharing, Bill. > > Can you also shed some light on these for us? > > 35 pointshare.com FAIL > 39 Pointshare.com FAIL > 10 pointshare.com FAIL > 17 pointshare.com PASS > 1 pointshare.com UNKNOWN The passes are from a system that sends notification messages to customer e-mail domains that we host, and since these ip address are include in our SPF record, they pass. The fails are from incoming mail that attempted to forge the from address to look like they were coming from [EMAIL PROTECTED] The unknown is due to a message that came in after I made an error in our SPF record which include a ?all instead of -all. Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
