Title: Message
Makes perfect sense to me.  Everyone, including ROKSO spammers, can benefit from implementing SPF defensively, resulting in a valid SPFPASS.  And *their* doing so dilutes the incentive for antispammers to reward those who implement SPF defensively, which in turn dilutes SPF.
 
As noted in the last 2 weeks, current wisdom is to add points to those senders that trigger a SPFFAIL, and that rewarding a SPFPASS or SPFUNKNOWN will reveal no joy.
 
Andrew 8)
-----Original Message-----
From: Matt [mailto:[EMAIL PROTECTED]
Sent: Friday, March 19, 2004 12:25 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] SPFPASS (Junk)

So zombie spamers forge Habeas, and ROKSO spammers give themselves SPF records.  Not a surprise.

You can't stop them from doing this, so I might suggest not crediting any points to those that pass.

Matt



Frederick Samarelli wrote:
This is the offending header.

Received: from mail13.americanfamilydeals.com ([69.56.11.46])
 by DNS2.tcbinc.net (SAVSMTP 3.1.3.37) with SMTP id M2004031909522726515
 for <[EMAIL PROTECTED]>; Fri, 19 Mar 2004 09:52:29 -0500
Message-ID:
<[EMAIL PROTECTED]>
Date: Fri, 19 Mar 2004 08:52:30 -0600 (CST)
From: "Point.com"
<[EMAIL PROTECTED]>
Reply-To: American Family Deals
<[EMAIL PROTECTED]>
To: Nancy Gladwell <[EMAIL PROTECTED]>
Subject: [~23]Cell Phone, Accessories & Shipping at NO Cost
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="----=_Part_1277094_8887513.1079707950959"
X-nb: zspttavsabivfviftpfnfnnn maifvvbmwpmfifmpa pmfwstssn
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail
detected. [2-3-1800]
X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63. [2-6-3000]
X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. [2-17-8800]
X-RBL-Warning: MAILPOLICE-BULK: This E-mail came from
mxllvniqnx.americanfamilydeals.com, a potential spam source listed in
MAILPOLICE-BULK. [2-26-d000]
X-RBL-Warning: SBL-XBL:
"http://www.spamhaus.org/SBL/sbl.lasso?query=SBL9613" [2-33-10800]
X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 426, weight 3)
[2-57-1c800]
X-Declude-Sender: [EMAIL PROTECTED]
[69.56.11.46]
X-Declude-Spoolname: D09300e8a005e2c5b.SMD
X-RBL-Warning: Total weight: 23
X-Note: Sent from: [EMAIL PROTECTED]
X-Note: Sent from Reverse DNS:  mail13.americanfamilydeals.com
([69.56.11.46]).
X-Note: This E-mail was scanned by TCB [1.78i21] for virus.

------=_Part_1277094_8887513.1079707950959
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

This message contains an HTML formatted message but your email client does =
not support the display of HTML. Please view this message in a different ma=
il client or forward this email to a web-based mail system.

------=_Part_1277094_8887513.1079707950959
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
----- Original Message ----- 
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, March 19, 2004 11:46 AM
Subject: Re: [Declude.JunkMail] SPFPASS (Junk)


  
What do we do when we find Junkmail passing the SPF Test.

Is there a place to report it.
      
It should be treated the same way as regular spam that you would report,
but there is a big exception here:  you can almost certainly find someone
responsible that allowed the spam through.

If you have the headers, feel free to post them here.

                                                    -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
    
(http://www.declude.com)]
  
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

    

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


  

-- 
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================

Reply via email to