I would propose that DNSBL processing of X-Originating-IP is appropriate but not using Spamhaus PBL or any “residential/dsl/cable" blocklist since those addresses are where you would expect webmail to come from. However, CBL and many other DNSbl lists would be appropriate for use here.
> On Mar 20, 2016, at 1:45 PM, K Post <nntp.p...@gmail.com> wrote: > > Thanks. > > Comcast is one of the biggest ISP's in the US. I've got to believe that > they have a massive amount of mail sent from their webmail systems. I'm > shocked that we didn't run into this sooner. Appreciate the fix! > > On Sun, Mar 20, 2016 at 3:27 AM, Thomas Eckardt <thomas.ecka...@thockar.com> > wrote: > >>> Is X-Originating-IP something that's checked? >> >> yes - this is a perfect information for assp >> >>> X-Originating-IP: [::ffff:W.X.Y.Z] >> >> this leads in to two IP's that are put at the IP-address stack - the >> extracted IPv4 followed by the expanded IPv6 (important: exactly in this >> order !) >> >> because : enhancedOriginIPDetect is set to "all but most origin" >> the IPv6 is removed from the stack - but the IPv4 (extracted from the same >> header line) is used as origin IP - this is wrong in this case and will be >> corrected in the next release >> >> Thank you >> >> Thomas >> >> >> >> >> Von: K Post <nntp.p...@gmail.com> >> An: ASSP development mailing list <assp-test@lists.sourceforge.net> >> Datum: 19.03.2016 23:22 >> Betreff: [Assp-test] Bad DNSBL detection >> >> >> >> Saw an email get rejected due to a hit on DNSBL. It was from a legit user >> using Comcast's (major ISP here in the US) webmail system. >> >> All of the received lines were fine, and the home cable modem's address >> was >> not listed there. >> >> However, there was a line below the received lines like this: >> X-Originating-IP: [::ffff:W.X.Y.Z] >> >> It looked like an IPV6 address, but my research showed that W.X.Y.Z was >> actually the ipv4 address of the user's home cable modem/router and that >> IP >> was correctly in DNSBL. >> >> enhancedOriginIPDetect is set to "all but most origin" >> >> I haven't seen this before, but could have certainly missed others. Just >> happened to catch this one. >> >> Is X-Originating-IP something that's checked? >> >> Bug? Did I do something wrong? Any way to insure this doesn't happen >> again? >> >> Thanks >> >> ------------------------------------------------------------------------------ >> Transform Data into Opportunity. >> Accelerate data analysis in your applications with >> Intel Data Analytics Acceleration Library. >> Click to learn more. >> http://pubads.g.doubleclick.net/gampad/clk?id=278785231&iu=/4140 >> _______________________________________________ >> Assp-test mailing list >> Assp-test@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/assp-test >> >> >> >> >> DISCLAIMER: >> ******************************************************* >> This email and any files transmitted with it may be confidential, legally >> privileged and protected in law and are intended solely for the use of the >> >> individual to whom it is addressed. >> This email was multiple times scanned for viruses. There should be no >> known virus in this email! >> ******************************************************* >> >> >> >> ------------------------------------------------------------------------------ >> Transform Data into Opportunity. >> Accelerate data analysis in your applications with >> Intel Data Analytics Acceleration Library. >> Click to learn more. >> http://pubads.g.doubleclick.net/gampad/clk?id=278785231&iu=/4140 >> _______________________________________________ >> Assp-test mailing list >> Assp-test@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/assp-test >> >> > ------------------------------------------------------------------------------ > Transform Data into Opportunity. > Accelerate data analysis in your applications with > Intel Data Analytics Acceleration Library. > Click to learn more. > http://pubads.g.doubleclick.net/gampad/clk?id=278785231&iu=/4140_______________________________________________ > Assp-test mailing list > Assp-test@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/assp-test ------------------------------------------------------------------------------ Transform Data into Opportunity. Accelerate data analysis in your applications with Intel Data Analytics Acceleration Library. Click to learn more. http://pubads.g.doubleclick.net/gampad/clk?id=278785231&iu=/4140 _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
