Jim Garrison wrote (after John Levine wrote):
>> When you looked at your outgoing mail logs for mail you sent yesterday >> to MTAs in the IP range 209.17.112.0/21, which is one of web.com's >> hosting farms, what did you find? > > My mail logs show no outgoing connections to any IP address in > 209.17.0.0/16. My server is very low volume (handles my personal > mail only). Here's the list of outgoing connections for the last > several days: John was perhaps simplifying a little too far. The report from Gmail is telling you that a message validly signed with your domain - and that domain or an aligned one in the From: header - arrived from the IP address in question. This seems like a pretty typical forwarding case, albeit with two or more steps instead of one. What is it that makes you think that the message has a "spoofed From: domain matching mine"? - Roland
_______________________________________________ dmarc-discuss mailing list dmarc-discuss@dmarc.org http://www.dmarc.org/mailman/listinfo/dmarc-discuss NOTE: Participating in this list means you agree to the DMARC Note Well terms (http://www.dmarc.org/note_well.html)
