Re: [sniffer]SPF

[Darin Cox]

What's your hold weight?  If spam is only failing SPF and nothing else, then the message doesn't get held, so you don't see it.   Also, I do not recommend negative weighting SPFPASS.  Spammers have SPF records, too, so you're giving them an opportunity to exploit it.   Lastly, I think you may be confused on your SPF records.  They should not have the "name" portion.  There is only one SPF record per domain.   So, for computerhouse.com, your SPF record should simply be   v=spf1 mx -all   which tells it your MX is allowed to send mail for your domain (the "mx" part) , but all others should fail ( the "-all" part).   Please keep related communication on the list for others' benefit as well. Darin.     ----- Original Message ----- From: Computer House Support To: [EMAIL PROTECTED] Sent: Tuesday, June 06, 2006 9:40 PM Subject: SPF Hi Darin,   Thanks for your offer to help.  I am E-mailing you off-list.   We do use Declude.  The entry in our $default$.junkmail file looks like this:   SPFFAIL   WARN SPFPASS   WARN SPFUNKNOWN  WARN   However, I have never seen an "SPF Failure" in the header of a spam mail.   Global.cfg:  SPFFAIL   spf  fail x 3 0 SPFPASS   spf  pass x -1 0     Our SPF Record looks like this:   computerhouse.com. IN TXT "v=spf1 mx mx:mail.computerhouse.com" mail.computerhouse.com. IN TXT "v=spf1 a -all"   Your insight is appreciated.     Michael Stein Computer House           ----- Original Message ----- From: Darin Cox To: Message Sniffer Community Sent: Tuesday, June 06, 2006 9:30 PM Subject: Re: [sniffer]Numeric spam What do you use for spam filtering?  Declude has the ability to test SPF, for example.   Also, what is your SPF record for the domain in question? Darin.