Hi Scott: Disregard! I found the DNS problem. It has nothing to do with the information that you are logging, though - it's the "include hmsoftware.de" that's failing on that machine.
Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Monday, December 22, 2003 11:32 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SPF still broken with v1.77i7? Hm, The lines are below, please note... A) [EMAIL PROTECTED] shows the same SPF text line -> and says "FAIL" (which is correct) B) yet, any HM-Software.com domains (using the same SPF text line) claim UNKNOWN because the DNS server did not respond!? C) I'm including an NSLOOKUP executed at the Imail/Declude machine against that DNS server: NSLOOKUP -------- D:\>nslookup Default Server: maywood-is-0002.webhost.hm-software.com Address: 63.107.174.65 > set type=txt > hm-software.com. hm-software.com text = "Fax: +1 (201) 934-9206; Phone: +1 (201) 934-3411, Ext. 20" hm-software.com text = "Owner: H&M Systems Software, Inc.; Upper Saddle River; NJ 07458-1846; U .S.A." hm-software.com text = "v=spf1 mx include:webhost.hm-software.com include:hmsoftware.de -all" > webhost.hm-software.com. webhost.hm-software.com text = "v=spf1 ip4:63.107.174.0/25 ip4:65.119.204.0/24 -all" > mail.webhost.hm-software.com. mail.webhost.hm-software.com text = "v=spf1 a -all" > smtp.webhost.hm-software.com. smtp.webhost.hm-software.com text = "v=spf1 a a:maywood-is-0003.webhost.hm-software.com -all" > set type=a > maywood-is-0003.webhost.hm-software.com. Name: maywood-is-0003.webhost.hm-software.com Addresses: 63.107.174.32, 65.119.204.32 YOUR SPF.LOG FILE ----------------- 63.107.174.164 [EMAIL PROTECTED] [SALESM1]: UNKNOWN: v=spf1 ip4:63.107.174.0/25 ip4:65.119.204.0/24 -all Sorry, the DNS server (63.107.174.65) did not respond with an answer (rcode=2). 67.104.140.226 [EMAIL PROTECTED] [ZPNC0017]: FAIL: v=spf1 ip4:63.107.174.0/25 ip4:65.119.204.0/24 -all 67.104.140.226 [EMAIL PROTECTED] [ZPNC0017]: FAIL: v=spf1 ip4:63.107.174.0/25 ip4:65.119.204.0/24 -all 67.104.140.226 [EMAIL PROTECTED] [ZPNC0017]: FAIL: v=spf1 ip4:63.107.174.0/25 ip4:65.119.204.0/24 -all 212.13.198.241 [EMAIL PROTECTED] [heifong.phase.org]: PASS: v=spf1 +a:heifong.phase.org -all 63.107.174.147 [EMAIL PROTECTED] [andyshome]: UNKNOWN: v=spf1 ip4:63.107.174.0/25 ip4:65.119.204.0/24 -all Sorry, the DNS server (63.107.174.65) did not respond with an answer (rcode=2). 63.107.174.147 [EMAIL PROTECTED] [andyshome]: UNKNOWN: v=spf1 ip4:63.107.174.0/25 ip4:65.119.204.0/24 -all Sorry, the DNS server (63.107.174.65) did not respond with an answer (rcode=2). Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Monday, December 22, 2003 10:09 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] SPF still broken with v1.77i7? >I just re-confirmed, > >THESE entries appear in the spf.log file: > >67.80.42.251 [EMAIL PROTECTED] [andyshome]: UNKNOWN ... >But the IP address 67.80.42.251 does not appear AT ALL in the spf.none >file! Thanks for pointing this out -- there is a new interim at http://www.declude.com/interim that will log extra information in this situation (which will still appear in the spf.log file). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
