Mark Constable wrote: > On 25 Jan 2008 16:29, Alessandro Vesely wrote: >> What was the HELO name they used? Perhaps you can >> retrieve the "newmsg" log entry for that message. > > I couldn't find a related message to this particular SPF > fail log entry but, separate issue, wouldn't the message > be rejected before courierd got a hold of it?
Well, the message is rejected after the MAIL FROM command even if it was the helo name that failed, but the 517 response line quotes the address that failed. In your case it was the domain "bankwest.com.au". Is it possible that the DNS changed after Jan 25 10:33:19 and before we manually checked it? > Now here is one that came in from the same IP, with a > From: address from another domain that does not have a > SPF record at all, and it was successfully delivered... > > Jan 25 07:27:06 mail courierd: newmsg, > id=00093385.479902A5.000001B2: dns; > mail191.messagelabs.com (mail191.messagelabs.com [::ffff:216.82.241.83]) The SPF=HELO check should have passed with "none", since mail191.messagelabs.com has no TXT record. Did that message use "bankwest.com.au" in the MAILFROM? BOFHSPFFROM defaults to "off", according to the docs, thus no Received-SPF for SPF=FROM should be present. ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ courier-users mailing list [email protected] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
