Personally, I don't like using A records (or MX records) in my SPF
entries -- it just makes the recipient do /*another */DNS lookup... on
MY DNS server!
When deciding what DOES GO into my SPF records, I like to do 2 things:
- First, I specify the IP addresses (eg: ip4 entries) of my own mail
servers -- these aren't likely to change often, as they come from MY ISP
(or, in my case, my ISPs)
- IMPORTANT: These are the PUBLIC IP addresses -- we're telling
people where the valid mail servers for my domain(s) are -- and those
ALWAYS appear as the WAN IP addresses, not the LAN IP addresses...
- Next, I specify the SPF RECORDS (eg: include entries) of my
secondary mail service providers (ISP Smart Hosts, SPAM filters, etc.)
- By using the INCLUDE, I let them decide what IP addresses they're
using for their server(s), and I won't ever be caught off-guard because
they changed something!
But what you should NEVER do, is specify LAN addresses -- /_*so the
192.168 addresses in your SPF records *_//_*HAVE TO GO*_//_!_/ (They
should NEVER be able to match on someone ELSE's LAN anyway... but if I
wanted to SPOOF a "local" mail server into accepting my inputs as coming
from YOUR domain, all I would have to do is setup my own "mini-LAN" with
my server sitting at the same LAN address you specified... and voila!
I'm an authorized sender for your domain!)
Just to be clear - your server at LAN IP 192.168.1.23 is NOT your
mailserver address -- When that server connects to the Internet, it does
so (probably with NAT) with an Internet Address (no 10/8, 172.16/12, or
192.168/16 addresses allowed!). ONLY THE INTERNET addresses should EVER
be advertised to outside locations.
So, if I host my own mail (with QMT on two separate servers) & my WAN IP
addresses from my ISP are 1.1.1.1 and 1.1.1.2, then my SPF record says:
"v=spf1 ip4:1.1.1.1 ip4:1.1.1.2 ~all"
This says: ALL of my mail should be coming FROM 1.1.1.1 or 1.1.1.2...
anything else should be suspect
If I'm confident with my SPF implementation, I might change that to:
"v=spf1 ip4:1.1.1.1 ip4:1.1.1.2 1 -all"
This says: ALL of my mail should be coming FROM 1.1.1.1 or 1.1.1.2...
anything else should be REJECTED
On the other hand, if my email is hosted at GMAIL, then my SPF record says:
"v=spf1 include:_spf.google.com -all"
This says: ALL of my mail should be coming from a GMAIL server (as
defined by GMAIL)... anything else should be REJECTED (I trust GMAIL to
do SPF correctly)
And finally, if I use GFI to do spam blocking for me, my SPF record
might look like:
"v=spf1 ip4:1.1.1.1 ip4:1.1.1.2 1 include:smtproutes.com -all"
This says: My mail might come from my server directly, or from one of
those GFI mail servers, but if not any of those, REJECT the message as
being false...
Hopefully this makes sense to y'all (I'm Southern -- even though this IS
Florida!) :-)
Dan McAllister
IT4SOHO
On 9/13/2013 5:00 AM, ChandranManikandan wrote:
Hi ,
My domains spf record below.
v=spf1 a:abc.com <http://abc.com> ip4:12.12.12.12/29
<http://12.12.12.12/29> a:abc123.com <http://abc123.com>
ip4:13.13.13.13 a:xxxx.com <http://xxxx.com> ip4:192.168.1.13
a:xyz.net <http://xyz.net> ip4:192.168.1.23 mx ~all
Note:
Here abc.com <http://abc.com> and ip4: 12.12.12.12/29
<http://12.12.12.12/29> is our third party domain and ip and we are
using online tool to receive emails from this domain
same abc123.com <http://abc123.com> and ip
xxx.com <http://xxx.com> and ip 192.168.1.13 is our another smtp
server. we are using this server for only outgoing email.
xyz.net <http://xyz.net> and ip 192.168.1.23 is my mail server and
which we are getting this message from server.
Please let me know my spf record is correct or do i need to change
anything.
I want to solve this issue. Please adivce to create my domains spf record.
On Fri, Sep 13, 2013 at 9:26 AM, Eric Shubert <[email protected]
<mailto:[email protected]>> wrote:
On 09/12/2013 05:35 AM, Dan McAllister wrote:
Actually, I usually see this when the "catchall" setting is
set to an
address that doesn't exist, or forwards to an address that
doesn't exist.
This also happens when, as Eric was alluding to, the "failure" is
actually fake -- the message it's complaining about wasn't
your message
to begin with (thus, backscatter).
My solution is a simple one... I stop playing so nicely
because I'm
tired of being taken advantage of... that is, I set all of my
domains
catchall setting to DELETED. Now, if you send mail to
[email protected] <mailto:[email protected]>
instead of [email protected]... you won't know you screwed up...
my mail
server will accept the mis-addressed mail and delete it.
The reduction in SPAM when I did that was measurable! Specifically
because people could no longer "mine" my mailserver for email
addresses.
They're all accepted, so "miners" quit trying -- everything
they try
appears to succeed, so they don't have a clue which ones
actually get
delivered.
An alternative (if you're worried about valid mis-directed
mail) is to
setup a special catchall account -- but be prepared to get a
lot of mail
in there!
I hope this helps
Dan McAllister
I agree with Dan that bouncing misaddressed email is a bad idea,
to keep miners at bay.
I do choose to use a catchall account account. I hardly get any
messages there at all, mostly misaddressed emails (eg DAM@). I can
imagine that some domains might get a lot of spam though.
--
-Eric 'shubes'
---------------------------------------------------------------------
To unsubscribe, e-mail:
[email protected]
<mailto:[email protected]>
For additional commands, e-mail:
[email protected]
<mailto:[email protected]>
--
*/Thanks & Best Regards,
Manikandan.C
/*
--
PLEASE TAKE NOTE OF OUR NEW ADDRESS
===================================
IT4SOHO, LLC
33 - 4th Street N, Suite 211
St. Petersburg, FL 33701-3806
CALL TOLL FREE:
877-IT4SOHO
877-484-7646 Phone
727-647-7646 Local
727-490-4394 Fax
We have support plans for QMail!
