On 09/13/2013 10:00 AM, Dan McAllister wrote:
But what you should NEVER do, is specify LAN addresses -- /_*so the 192.168 addresses in your SPF records *_//_*HAVE TO GO*_//_!_/ (They should NEVER be able to match on someone ELSE's LAN anyway... but if I wanted to SPOOF a "local" mail server into accepting my inputs as coming from YOUR domain, all I would have to do is setup my own "mini-LAN" with my server sitting at the same LAN address you specified... and voila! I'm an authorized sender for your domain!)
This is why I believe all submissions should be required to authenticate. Otherwise you have a semi-open relay. Entries in the tcp.smtp file which set the RELAYCLIENT variable should be used with large dose of caution.
And finally, if I use GFI to do spam blocking for me, my SPF record might look like: "v=spf1 ip4:1.1.1.1 ip4:1.1.1.2 1 include:smtproutes.com -all" This says: My mail might come from my server directly, or from one of those GFI mail servers, but if not any of those, REJECT the message as being false...
This is a little confusing. GFI provides outbound email services (which this relates to) in addition to spam blocking, which is an inbound service. Setting up your SPF record applies only to your outbound email. The inbound portion of SPF is controlled simply by the spfbehavior file. Just want to be clear in this respect.
Thanks for your great reply, Dan! -- -Eric 'shubes' --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
