I looked at the last week of blocked email from Travelocity.com and found just one blocked message.
It was a flight change email from [email protected] with a source IP of 66.244.67.50. fbulk@frankb-PC:/mnt/c/Users/fbulk$ dig TXT e.travelocity.com +short "spf2.0/pra include:cust-senderid.exacttarget.com -all" "v=spf1 include:cust-spf.exacttarget.com -all" fbulk@frankb-PC:/mnt/c/Users/fbulk$ dig TXT cust-spf.exacttarget.com +short "v=spf1 ip4:64.132.92.0/24 ip4:64.132.88.0/23 ip4:66.231.80.0/20 ip4:68.232.192.0/20 ip4:199.122.120.0/21 ip4:207.67.38.0/24 " "ip4:207.67.98.192/27 ip4:207.250.68.0/24 ip4:209.43.22.0/28 ip4:198.245.80.0/20 ip4:136.147.128.0/20 ip4:136.147.176.0/20 ip4:13.111.0.0/18 -all" fbulk@frankb-PC:/mnt/c/Users/fbulk$ Besides cust-spf-exacttarget.com having some extra quotes in their SPF record, you can see that 66.244.67.50 is not in the above SPF record(s). Frank -----Original Message----- From: mailop [mailto:[email protected]] On Behalf Of Carl Byington Sent: Friday, May 19, 2017 11:55 AM To: [email protected] Subject: Re: [mailop] Many SPF failures lately -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Fri, 2017-05-19 at 03:49 -0500, [email protected] wrote: > Most well-known cuplprit is Travelocity and their flight change > notifications. The only travelocity mail I see here is from [email protected] via 192.161.140.0/24. Are the flight change notifications from some other system? ac.travelocity.com CNAME -> travelocity.neolane.net travelocity.neolane.net TXT -> redirect p140.neolane.net p140.neolane.net TXT "v=spf1 ip4:192.161.140.0/24 -all" Even if spf fails, we would accept those based on the DKIM signature by ac.travelocity.com which is listed in our local policy database. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iEYEAREKAAYFAlkfI0oACgkQL6j7milTFsF0QgCfU/e06B6EOZ9sOLGOUX+HBtpV X1UAnjCwr/FwQXA3jbew/nHT1IVC2apB =Iv5/ -----END PGP SIGNATURE----- _______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop _______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
