the results '127.0.0.10','127.0.0.11' from
'zen.spamhaus.org' and 'pbl.spamhaus.org'
are ignored for all origin IP's
Thomas
Von: TR Shaw <ts...@oitc.com>
An: ASSP development mailing list <assp-test@lists.sourceforge.net>
Datum: 20.03.2016 22:03
Betreff: Re: [Assp-test] Bad DNSBL detection
I would propose that DNSBL processing of X-Originating-IP is appropriate
but not using Spamhaus PBL or any “residential/dsl/cable" blocklist since
those addresses are where you would expect webmail to come from. However,
CBL and many other DNSbl lists would be appropriate for use here.
> On Mar 20, 2016, at 1:45 PM, K Post <nntp.p...@gmail.com> wrote:
>
> Thanks.
>
> Comcast is one of the biggest ISP's in the US. I've got to believe that
> they have a massive amount of mail sent from their webmail systems. I'm
> shocked that we didn't run into this sooner. Appreciate the fix!
>
> On Sun, Mar 20, 2016 at 3:27 AM, Thomas Eckardt
<thomas.ecka...@thockar.com>
> wrote:
>
>>> Is X-Originating-IP something that's checked?
>>
>> yes - this is a perfect information for assp
>>
>>> X-Originating-IP: [::ffff:W.X.Y.Z]
>>
>> this leads in to two IP's that are put at the IP-address stack - the
>> extracted IPv4 followed by the expanded IPv6 (important: exactly in
this
>> order !)
>>
>> because : enhancedOriginIPDetect is set to "all but most origin"
>> the IPv6 is removed from the stack - but the IPv4 (extracted from the
same
>> header line) is used as origin IP - this is wrong in this case and will
be
>> corrected in the next release
>>
>> Thank you
>>
>> Thomas
>>
>>
>>
>>
>> Von: K Post <nntp.p...@gmail.com>
>> An: ASSP development mailing list <assp-test@lists.sourceforge.net>
>> Datum: 19.03.2016 23:22
>> Betreff: [Assp-test] Bad DNSBL detection
>>
>>
>>
>> Saw an email get rejected due to a hit on DNSBL. It was from a legit
user
>> using Comcast's (major ISP here in the US) webmail system.
>>
>> All of the received lines were fine, and the home cable modem's address
>> was
>> not listed there.
>>
>> However, there was a line below the received lines like this:
>> X-Originating-IP: [::ffff:W.X.Y.Z]
>>
>> It looked like an IPV6 address, but my research showed that W.X.Y.Z was
>> actually the ipv4 address of the user's home cable modem/router and
that
>> IP
>> was correctly in DNSBL.
>>
>> enhancedOriginIPDetect is set to "all but most origin"
>>
>> I haven't seen this before, but could have certainly missed others.
Just
>> happened to catch this one.
>>
>> Is X-Originating-IP something that's checked?
>>
>> Bug? Did I do something wrong? Any way to insure this doesn't happen
>> again?
>>
>> Thanks
>>
>>
------------------------------------------------------------------------------
>> Transform Data into Opportunity.
>> Accelerate data analysis in your applications with
>> Intel Data Analytics Acceleration Library.
>> Click to learn more.
>> http://pubads.g.doubleclick.net/gampad/clk?id=278785231&iu=/4140
>> _______________________________________________
>> Assp-test mailing list
>> Assp-test@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/assp-test
>>
>>
>>
>>
>> DISCLAIMER:
>> *******************************************************
>> This email and any files transmitted with it may be confidential,
legally
>> privileged and protected in law and are intended solely for the use of
the
>>
>> individual to whom it is addressed.
>> This email was multiple times scanned for viruses. There should be no
>> known virus in this email!
>> *******************************************************
>>
>>
>>
>>
------------------------------------------------------------------------------
>> Transform Data into Opportunity.
>> Accelerate data analysis in your applications with
>> Intel Data Analytics Acceleration Library.
>> Click to learn more.
>> http://pubads.g.doubleclick.net/gampad/clk?id=278785231&iu=/4140
>> _______________________________________________
>> Assp-test mailing list
>> Assp-test@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/assp-test
>>
>>
>
------------------------------------------------------------------------------
> Transform Data into Opportunity.
> Accelerate data analysis in your applications with
> Intel Data Analytics Acceleration Library.
> Click to learn more.
>
http://pubads.g.doubleclick.net/gampad/clk?id=278785231&iu=/4140_______________________________________________
> Assp-test mailing list
> Assp-test@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/assp-test
------------------------------------------------------------------------------
Transform Data into Opportunity.
Accelerate data analysis in your applications with
Intel Data Analytics Acceleration Library.
Click to learn more.
http://pubads.g.doubleclick.net/gampad/clk?id=278785231&iu=/4140
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Transform Data into Opportunity.
Accelerate data analysis in your applications with
Intel Data Analytics Acceleration Library.
Click to learn more.
http://pubads.g.doubleclick.net/gampad/clk?id=278785351&iu=/4140
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
