Re: [Declude.JunkMail] SPF question
Thanks, Scott. Ben - Original Message - From: R. Scott Perry [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, October 21, 2004 2:42 PM Subject: Re: [Declude.JunkMail] SPF question I have a question about setting up the SPF string. If I use this string: v=spf1 a mx a:bcw5, a:bcw6 -all as a text record in our domain (bcwebhost.net), then the SPF test checks the sending IP and tries to match it against either bcw5.bcwebhost.net or bcw6.bcwebhost.net. The -all option says that if the sending IP doesn't match one of those two, the test fails. Now when I send out mail, it goes out through an IP (66.224.41.4 -- our firewall) that doesn't belong to that domain. So how do I get the SPF test to pass for email coming from this IP address? You just need to add ip4:66.224.41.4 to the SPF record, and you should be all set. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPF question
Hi, I have a question about setting up the SPF string. If I use this string: v=spf1 a mx a:bcw5, a:bcw6 -all as a text record in our domain (bcwebhost.net), then the SPF test checks the sending IP and tries to match it against either bcw5.bcwebhost.net or bcw6.bcwebhost.net. The -all option says that if the sending IP doesn't match one of those two, the test fails. Now when I send out mail, it goes out through an IP (66.224.41.4 -- our firewall) that doesn't belong to that domain. So how do I get the SPF test to pass for email coming from this IP address? Thanks, Ben BC Web --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPF question
I have a question about setting up the SPF string. If I use this string: v=spf1 a mx a:bcw5, a:bcw6 -all as a text record in our domain (bcwebhost.net), then the SPF test checks the sending IP and tries to match it against either bcw5.bcwebhost.net or bcw6.bcwebhost.net. The -all option says that if the sending IP doesn't match one of those two, the test fails. Now when I send out mail, it goes out through an IP (66.224.41.4 -- our firewall) that doesn't belong to that domain. So how do I get the SPF test to pass for email coming from this IP address? You just need to add ip4:66.224.41.4 to the SPF record, and you should be all set. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPF - Question
From another list I get: Quote ON ...we now have seven return codes, up from the previous four, and the Received-SPF field is now more structured. The total number of domains covered by SPF is actually much, much higher than 7000. That number comes from self-reporting. The true number is higher because many domain-parking services have set up a blanket this domain sends no mail rule. Thanks to them, the total number of domains covered by SPF is in the six-digit range. QUOTE OFF Question: For those of us who set up SPF early, are there any changes we need to make, either to the information on our servers, or the information we submitted to the SPF registry (or whatever its correct name should be)? I believe we currently have a spfpass and a spffail in our global.cfg. Thanks, Rob === www.iGive.com --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPF - Question
...we now have seven return codes, up from the previous four, and the Received-SPF field is now more structured. The SPF protocol is still being changed. The SPF code in Declude JunkMail follows one of the specs from December -- we expect to add support for the final one after the final specs are determined. For those of us who set up SPF early, are there any changes we need to make, either to the information on our servers, or the information we submitted to the SPF registry (or whatever its correct name should be)? Not at this time. Once the RFC draft is finalized, and we change Declude JunkMail to match it, then some changes may be necessary. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] SPF Question
Scott, I have setup an SPF record for pointshare.com as follows: TXT v=spf1 ipv4:206.114.136.0/23 ipv4:206.114.143.240/28 a:psmail02.pointshare.com ptr mx/24 -all I then sent out a test message from at yahoo account with a pointshare.com e-mail address. Here is a snippet of the log entries for this message: BLARSBL:2 FORGED-DOMAINS:5 SNIFFER-WHITERULE:-3 REDUCTION-FILTER:-10 VERP-FILTER:5 . Total weight = -1. NOT bypassing whitelisting of E-mail with weight =16 (-1) and at least 2 recipients (1). Using [outgoing] CFG file global.cfg. Msg failed BLARSBL (This E-mail came from 66.163.169.226, a potential spam source listed in BLARSBL.). Action=WARN. Msg failed IPNOTINMX (). Action=WARN. Msg failed NOLEGITCONTENT (No content unique to legitimate E-mail detected.). Action=WARN. Msg failed FORGED-DOMAINS (Spamdomain '@pointshare.com' found: Address of [EMAIL PROTECTED] sent from invalid smtp106.mail.sc5.yahoo.com.). Action=WARN. Msg failed SNIFFER-WHITERULE (Message failed SNIFFER-WHITERULE: 0.). Action=WARN. Msg failed REDUCTION-FILTER (Message failed REDUCTION-FILTER test (line 545, weight 0)). Action=WARN. Msg failed VERP-FILTER (Message failed VERP-FILTER test (line 64, weight 5)). Action=WARN. R1 Message OK Subject: test 3 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] IP: 66.163.169.226 ID: C4812ADA13 Last action = IGNORE. I would have thought that this message should have failed the SPF test, however, here is what was entered in the spf.log: 66.163.169.226 [EMAIL PROTECTED] [smtp106.mail.sc5.yahoo.com]: UNKNOWN Any idea why this did not get a fail instead of unknown? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] SPF Question
Scott, I have setup an SPF record for pointshare.com as follows: TXT v=spf1 ipv4:206.114.136.0/23 ipv4:206.114.143.240/28 a:psmail02.pointshare.com ptr mx/24 -all At first, I thought that was fine -- but it isn't. After checking it at http://www.dnsstuff.com/pages/spf.htm , it seems that the TXT record should be: TXT v=spf1 ip4:206.114.136.0/23 ip4:206.114.143.240/28 a:psmail02.pointshare.com ptr mx/24 -all with the ipv4:'s being changed to ip4:. Since ipv4: isn't a defined mechanism, a result of UNKNOWN is returned. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
