I have to agree with Matt. I am starting to see quite a few spam messages from the same spammer that has now implemented SPF for the following three domains:
yfdvdsmail.com freefamilydeals.com americanfamilydeals.com I primarily now use SPF for adding negative weight for SPF fails. Bill ----- Original Message ----- From: "Matt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, March 19, 2004 12:25 PM Subject: Re: [Declude.JunkMail] SPFPASS (Junk) > So zombie spamers forge Habeas, and ROKSO spammers give themselves SPF > records. Not a surprise. > > You can't stop them from doing this, so I might suggest not crediting > any points to those that pass. > > Matt > > > > Frederick Samarelli wrote: > > > This is the offending header. > > > > Received: from mail13.americanfamilydeals.com ([69.56.11.46]) > > by DNS2.tcbinc.net (SAVSMTP 3.1.3.37) with SMTP id M2004031909522726515 > > for <mailto:[EMAIL PROTECTED]> <[EMAIL PROTECTED]>; > Fri, 19 Mar 2004 09:52:29 -0500 > > Message-ID: > > > <mailto:[EMAIL PROTECTED] > als.com> > <[EMAIL PROTECTED] > > > > Date: Fri, 19 Mar 2004 08:52:30 -0600 (CST) > > From: "Point.com" > > <mailto:[EMAIL PROTECTED]> > <[EMAIL PROTECTED]> > > Reply-To: American Family Deals > > <mailto:[EMAIL PROTECTED]> > <[EMAIL PROTECTED]> > > To: Nancy Gladwell <mailto:[EMAIL PROTECTED]> > <[EMAIL PROTECTED]> > > Subject: [~23]Cell Phone, Accessories & Shipping at NO Cost > > Mime-Version: 1.0 > > Content-Type: multipart/alternative; > > boundary="----=_Part_1277094_8887513.1079707950959" > > X-nb: zspttavsabivfviftpfnfnnn maifvvbmwpmfifmpa pmfwstssn > > X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail > > detected. [2-3-1800] > > X-RBL-Warning: SNIFFER: Message failed SNIFFER: 63. [2-6-3000] > > X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. [2-17-8800] > > X-RBL-Warning: MAILPOLICE-BULK: This E-mail came from > > mxllvniqnx.americanfamilydeals.com, a potential spam source listed in > > MAILPOLICE-BULK. [2-26-d000] > > X-RBL-Warning: SBL-XBL: > > "http://www.spamhaus.org/SBL/sbl.lasso?query=SBL9613"; > <http://www.spamhaus.org/SBL/sbl.lasso?query=SBL9613> [2-33-10800] > > X-RBL-Warning: GIBBERISH: Message failed GIBBERISH test (line 426, > weight 3) > > [2-57-1c800] > > X-Declude-Sender: > [EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]> > > [69.56.11.46] > > X-Declude-Spoolname: D09300e8a005e2c5b.SMD > > X-RBL-Warning: Total weight: 23 > > X-Note: Sent from: > [EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]> > > X-Note: Sent from Reverse DNS: mail13.americanfamilydeals.com > > ([69.56.11.46]). > > X-Note: This E-mail was scanned by TCB [1.78i21] for virus. > > > > ------=_Part_1277094_8887513.1079707950959 > > Content-Type: text/plain; charset=ISO-8859-1 > > Content-Transfer-Encoding: quoted-printable > > > > This message contains an HTML formatted message but your email client > does = > > not support the display of HTML. Please view this message in a different > ma= > > il client or forward this email to a web-based mail system. > > > > ------=_Part_1277094_8887513.1079707950959 > > Content-Type: text/html; charset=ISO-8859-1 > > Content-Transfer-Encoding: quoted-printable > > ----- Original Message ----- > > From: "R. Scott Perry" <mailto:[EMAIL PROTECTED]> > <[EMAIL PROTECTED]> > > To: <mailto:[EMAIL PROTECTED]> > <[EMAIL PROTECTED]> > > Sent: Friday, March 19, 2004 11:46 AM > > Subject: Re: [Declude.JunkMail] SPFPASS (Junk) > > > > > > > > What do we do when we find Junkmail passing the SPF Test. > > > > Is there a place to report it. > > > > It should be treated the same way as regular spam that you would report, > > but there is a big exception here: you can almost certainly find > someone > > responsible that allowed the spam through. > > > > If you have the headers, feel free to post them here. > > > > -Scott > > --- > > Declude JunkMail: The advanced anti-spam solution for IMail mailservers > > since 2000. > > Declude Virus: Ultra reliable virus detection and the leader in > mailserver > > vulnerability detection. > > Find out what you've been missing: Ask for a free 30-day evaluation. > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > > > > ( http://www.declude.com <http://www.declude.com> )] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]> , and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com <http://www.mail-archive.com> . > > > > > > > > --- > > [This E-mail was scanned for viruses by Declude Virus ( > http://www.declude.com <http://www.declude.com> )] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]> , and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com <http://www.mail-archive.com> . > > > > > > > > > -- > > ===================================================== > > MailPure custom filters for Declude JunkMail Pro. > > http://www.mailpure.com/software/ <http://www.mailpure.com/software/> > > ===================================================== > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
