Re: [mailop] Mysterious DKIM failure.

[Steve Atkins]

> On Dec 9, 2016, at 5:59 PM, Luke Martinez  wrote:
> 
> Thanks for the insights Steve,
> 
> Any thoughts on why the indentation would be different? As far as I know, 
> this message was built once, and then it was sent to several different 
> recipients. I can't guess why the results would be different when being sent 
> to different outlook.com recipients. Also noteworthy...Subsequent test 
> messages (different content, but same config) sent to the same addresses 
> produced different results (attached) 

Looks like someone along the delivery path is expanding tabs, but it's hard to 
say more without looking at wider data. 

Unless I saw something to suggest otherwise I'd assume that it's something to 
do with the delivery path rather than the recipient. I'd look at the smarthosts 
they went through (is something configured differently on them?) and the MXes 
that received them.

The messages have differing indentation on the X-Microsoft-Exchange-Diagnostics 
headers, which strongly suggests it's inside something at Microsoft.

You could reach out to someone who's at Microsoft and ask them to take a look.

Though I'd probably try injecting identical-ish messages into outlook.com's 
dozens of MXes and see if there were any pattern first. Easy enough to 
black-box it with swaks and a shell script.

Cheers,
  Steve

> 
> On Fri, Dec 9, 2016 at 5:57 PM, Steve Atkins  wrote:
> 
> > On Dec 9, 2016, at 3:36 PM, Luke Martinez via mailop  
> > wrote:
> >
> > I've got some DKIM failures I'm having trouble figuring out. Below are two 
> > identical messages sent to two different outlook.com recipients from the 
> > same infrastructure. One is failing DKIM, the other isn't.
> >
> > This issue is semi-repeatable, with some addresses failing DKIM and others 
> > passing seemingly at random.
> >
> > I was wondering if anyone could help me identify the cause of the DKIM 
> > failure, or let me know if this is just a thing that happens on occasion. 
> > I've attached the full messages and pasted the two headers.
> 
> dkimpass.txt indents some lines (e.g. DECK THE HALLS) with three tabs, while 
> dkimfail.txt indents those same lines with six spaces.
> 
> For mail that otherwise looks like it's coming from the same template that's 
> very suspicious.
> 
> Cheers,
>   Steve
> 
> 
> 
> 
> -- 
> 
> Luke Martinez
> Team Lead | Email Delivery
> 520.400.5693
> 


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Mysterious DKIM failure.

[Luke Martinez via mailop]

Thanks for the insights Steve,

Any thoughts on why the indentation would be different? As far as I know,
this message was built *once*, and then it was sent to several different
recipients. I can't guess why the results would be different when being
sent to different outlook.com recipients. Also noteworthy...Subsequent test
messages (different content, but same config) sent to the same addresses
produced different results (attached)

On Fri, Dec 9, 2016 at 5:57 PM, Steve Atkins  wrote:

>
> > On Dec 9, 2016, at 3:36 PM, Luke Martinez via mailop 
> wrote:
> >
> > I've got some DKIM failures I'm having trouble figuring out. Below are
> two identical messages sent to two different outlook.com recipients from
> the same infrastructure. One is failing DKIM, the other isn't.
> >
> > This issue is semi-repeatable, with some addresses failing DKIM and
> others passing seemingly at random.
> >
> > I was wondering if anyone could help me identify the cause of the DKIM
> failure, or let me know if this is just a thing that happens on occasion.
> I've attached the full messages and pasted the two headers.
>
> dkimpass.txt indents some lines (e.g. DECK THE HALLS) with three tabs,
> while dkimfail.txt indents those same lines with six spaces.
>
> For mail that otherwise looks like it's coming from the same template
> that's very suspicious.
>
> Cheers,
>   Steve
>
>


-- 

Luke Martinez
Team Lead | Email Delivery
520.400.5693
Received: from BY1PR13CA0003.namprd13.prod.outlook.com (10.162.107.141) by
 MWHPR13MB1536.namprd13.prod.outlook.com (10.175.140.137) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.771.4 via Mailbox Transport; Fri, 9 Dec 2016 23:22:18 +
Received: from inbound.mail.protection.outlook.com (216.32.180.120) by
 BY1PR13CA0003.outlook.office365.com (10.162.107.141) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.789.5 via Frontend Transport; Fri, 9 Dec 2016 23:22:18 +
Received: from BN3NAM04FT006.eop-NAM04.prod.protection.outlook.com
 (10.152.92.52) by BN3NAM04HT188.eop-NAM04.prod.protection.outlook.com
 (10.152.93.73) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.761.6; Fri, 9 Dec
 2016 23:22:15 +
Authentication-Results: spf=pass (sender IP is 167.89.0.244)
 smtp.mailfrom=e.email.silpada.com; outlook.com; dkim=pass (signature was
 verified) header.d=email.silpada.com;outlook.com; dmarc=bestguesspass
 action=none header.from=email.silpada.com;
Received-SPF: Pass (protection.outlook.com: domain of e.email.silpada.com
 designates 167.89.0.244 as permitted sender) receiver=protection.outlook.com;
 client-ip=167.89.0.244; helo= o1.e.email.silpada.com;
Received: from SNT004-MC11F2.hotmail.com (10.152.92.58) by
 BN3NAM04FT006.mail.protection.outlook.com (10.152.92.96) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
 15.1.761.6 via Frontend Transport; Fri, 9 Dec 2016 23:22:14 +
X-IncomingTopHeaderMarker: 
OriginalChecksum:1F3929AE2F421F64D0759B2072B637C65D5AF4E5513CB8339CFC5A1EBEED385F;UpperCasedChecksum:1CC256260B9A51AE7529A9CC4ADA8A78374D893F53BE50BFC6F0D101842205F2;SizeAsReceived:1631;Count:14
Received: from o1.e.email.silpada.com ([167.89.0.244]) by 
SNT004-MC11F2.hotmail.com over TLS secured channel with Microsoft 
SMTPSVC(7.5.7601.23143);
 Fri, 9 Dec 2016 15:22:13 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=email.silpada.com; 
h=content-type:from:mime-version:subject:to; s=s1; 
bh=l7Nvk3mH4ILxblffMVyzawXYOcM=; b=XgeUIoznQmsqUw48sfcsq2+FwnMNL
yJPVEhy90/bU3b+7P/gTmRkfd2Z//9X/7S5XIw+4+5ymHdeZMSbL3giRWjInkdbT
/0Jsp0kwRIgj7pp6dtDRO3Y6DO9kz12YmVcIqKmoXq1ZYOL1vlB9ninocVdUagfs
DpsI3F4lq3AaQk=
Received: by filter0974p1mdw1.sendgrid.net with SMTP id 
filter0974p1mdw1-2201-584B3CA3-2D
2016-12-09 23:22:11.650615498 + UTC
Received: from NDAyMzM2NQ (o16789125x224.outbound-mail.sendgrid.net 
[167.89.125.224])
by ismtpd0005p1iad1.sendgrid.net (SG) with HTTP id 
ByTzwSvuSdmKofzSqvl52Q
for ; Fri, 09 Dec 2016 23:22:11.581 + 
(UTC)
Content-Type: multipart/alternative; 
boundary=de75af6eb0ec36ce29f87fd5ce4e4ccb371b0db3b5bdfe7604c05473375e
Date: Fri, 9 Dec 2016 23:22:11 +
From: silp...@email.silpada.com
Subject: From SendGrid
To: matthew.que...@outlook.com
Message-ID: 
X-SG-EID: 
/4D4wegxXCO+mN92/eWzN4CqIJM27SJeUDkqWNtyz3PaCzoitt8v4Yw940wWRRfStz+ZRR+2jMRyrI
 Drv/wqO3MTwDWvMq3Tf7acVRy2gpnomAnVM5B9jXUne1tRosX++I1tqTzYvPDT/pWNzDPSdbrtvCuX
 HbFxf3wSvBLej9pvd5L645hwXeZnPIhcYlK7Cr869bjbApdWF5Nk6n8qnw==
Return-Path: bounces+4023365-dfaf-matthew.quebec=outlook@e.email.silpada.com
X-OriginalArrivalTime: 09 Dec 2016 23:22:13.0132 (UTC) 
FILETIME=[1271A4C0:01D25273]
X-IncomingHeaderCount: 

Re: [mailop] Spamcannibal?

[Renaud Allard via mailop]

spamcannibal has its uses, mainly in a scoring system. But indeed, 
refusing emails solely on the reason that the mail server is listed on 
spamcannibal is probably a poor idea.
Actually, refusing emails by relying solely on any blacklist which lists 
ranges instead of individual IPs is a poor idea (except maybe for ipv6).


On 09/12/2016 16:44, Gil Bahat via mailop wrote:

+1 unreasonable for an indiscriminate block on all of Amazon SES. Why
would anyone want to use such a BL is beyond me given that there are
many, much better alternatives.

On Dec 9, 2016 5:30 PM, "Vladimir Dubrovin via mailop"
> wrote:

25.11.2016 22:50, Al Iverson пишет:

Hi Otto,

Long time no talk. Hope things are going well.

The Spam Cannibal maintainer is a reasonable guy. He doesn't spread
his contact info far and wide, perhaps because he doesn't want to
argue with spammers. So, I would feel bad about sharing his details
publicly. But I will forward your post to him and invite him to follow
up with you. Hope that helps.


I really doubt it. This reasonable guys blacklisted our (Mail.Ru)
front servers due to same reason ('Generic PTR'). Yes, we have few
hundreds of front servers, because we host >50% of mailboxes for
russian-speaking users so we need to count our servers somehow. If
you use Spamcannibal you will probably have deliverability problems.





Best regards,
Al Iverson

--
Al Iverson
www.aliverson.com 
(312)725-0130


On Fri, Nov 25, 2016 at 8:14 AM, Otto J. Makela  
 wrote:

Sending this to a couple of secret societies, apologies if you see this 
twice.

Is there any point in trying to contact Spamcannibal?

One of our clients (we're the Finnish NREN, so an university in Finland)
was notified via Shadowserver that a swathe of their unused IP space is
listed on Spamcannibal:

https://www.shadowserver.org/wiki/pmwiki.php/Services/Blacklist


Since the network in question has no assigned addresses, there are no DNS
records for it. We suspect that the netblock was momentarily snatched from
them via BGP (or some other routing trick) and then used to send spam.
We'd really like to know more, like get spamples or at least time stamps.

When I tried to get in touch with Spamcannibal about one IP address via
their contact form, submitting the form resulted in the glib message:

xxx.xxx.xxx.xxx not eligible for removal: GENERIC PTR

So, anyone know if the form went through, does someone have a contact there,
and is there any point in doing so?

--
   /* * * Otto J. Makela   * * * * * * * * 
* */
  /* Phone: +358 40 765 5772 , ICBM: N 60 10' 
E 24 55' */
 /* Mail: Mechelininkatu 26 B 27,  FI-00100 Helsinki */
/* * * Computers Rule 0100 01001011 * * * * * * */

___
mailop mailing list
mailop@mailop.org 
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


___
mailop mailing list
mailop@mailop.org 
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop




--
Vladimir Dubrovin
@Mail.Ru

___
mailop mailing list
mailop@mailop.org 
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop





___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop





smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Spamcannibal?

[Gil Bahat via mailop]

That is correct. At least from my personal perspective, the solution was to
find out if any major destination was making decisions based on this list.

After engaging that sole meaningful provider, I'm happy to report they
dropped spamcannibal. So unless someone picked it up, you can likely safely
ignore any spamcannibal listing.

The list maintainer couldn't care less about my concerns and that's his
prerogative, just like it's mine to try and convince it's few remaining
users to drop it.

On Dec 9, 2016 6:13 PM, "Al Iverson"  wrote:

Every blacklist operator has done something that has pissed somebody off at
some point. I recognize their right to exist, and tend not to judge, even
if they don't run things they way I would. Life is more pleasant and
stress-free that way.

Because even though you might say "why would you ever use that piece of
crap" about any blacklist -- and you could even be correct some of the time
-- but somebody does use it somewhere, so it exists and one has to deal
with it sometimes.

Cheers,
Al


--
Al Iverson
www.aliverson.com
(312)725-0130 <(312)%20725-0130>

On Fri, Dec 9, 2016 at 10:44 AM, Gil Bahat via mailop 
wrote:

> +1 unreasonable for an indiscriminate block on all of Amazon SES. Why
> would anyone want to use such a BL is beyond me given that there are many,
> much better alternatives.
>
> On Dec 9, 2016 5:30 PM, "Vladimir Dubrovin via mailop" 
> wrote:
>
> 25.11.2016 22:50, Al Iverson пишет:
>
> Hi Otto,
>
> Long time no talk. Hope things are going well.
>
> The Spam Cannibal maintainer is a reasonable guy. He doesn't spread
> his contact info far and wide, perhaps because he doesn't want to
> argue with spammers. So, I would feel bad about sharing his details
> publicly. But I will forward your post to him and invite him to follow
> up with you. Hope that helps.
>
>
> I really doubt it. This reasonable guys blacklisted our (Mail.Ru) front
> servers due to same reason ('Generic PTR'). Yes, we have few hundreds of
> front servers, because we host >50% of mailboxes for russian-speaking users
> so we need to count our servers somehow. If you use Spamcannibal you will
> probably have deliverability problems.
>
>
>
> Best regards,
> Al Iverson
>
> --
> Al Iversonwww.aliverson.com(312)725-0130 <(312)%20725-0130>
>
>
> On Fri, Nov 25, 2016 at 8:14 AM, Otto J. Makela   
> wrote:
>
> Sending this to a couple of secret societies, apologies if you see this twice.
>
> Is there any point in trying to contact Spamcannibal?
>
> One of our clients (we're the Finnish NREN, so an university in Finland)
> was notified via Shadowserver that a swathe of their unused IP space is
> listed on Spamcannibal:
> https://www.shadowserver.org/wiki/pmwiki.php/Services/Blacklist
>
> Since the network in question has no assigned addresses, there are no DNS
> records for it. We suspect that the netblock was momentarily snatched from
> them via BGP (or some other routing trick) and then used to send spam.
> We'd really like to know more, like get spamples or at least time stamps.
>
> When I tried to get in touch with Spamcannibal about one IP address via
> their contact form, submitting the form resulted in the glib message:
>
> xxx.xxx.xxx.xxx not eligible for removal: GENERIC PTR
>
> So, anyone know if the form went through, does someone have a contact there,
> and is there any point in doing so?
>
> --
>/* * * Otto J. Makela   * * * * * * * * * */
>   /* Phone: +358 40 765 5772, ICBM: N 60 10' E 24 55' */
>  /* Mail: Mechelininkatu 26 B 27,  FI-00100 Helsinki */
> /* * * Computers Rule 0100 01001011 * * * * * * */
>
> ___
> mailop mailing 
> listmailop@mailop.orghttps://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
> ___
> mailop mailing 
> listmailop@mailop.orghttps://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
>
> --
> Vladimir Dubrovin
> [image: @Mail.Ru]
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Spamcannibal?

[Al Iverson]

Every blacklist operator has done something that has pissed somebody off at
some point. I recognize their right to exist, and tend not to judge, even
if they don't run things they way I would. Life is more pleasant and
stress-free that way.

Because even though you might say "why would you ever use that piece of
crap" about any blacklist -- and you could even be correct some of the time
-- but somebody does use it somewhere, so it exists and one has to deal
with it sometimes.

Cheers,
Al


--
Al Iverson
www.aliverson.com
(312)725-0130 <(312)%20725-0130>

On Fri, Dec 9, 2016 at 10:44 AM, Gil Bahat via mailop 
wrote:

> +1 unreasonable for an indiscriminate block on all of Amazon SES. Why
> would anyone want to use such a BL is beyond me given that there are many,
> much better alternatives.
>
> On Dec 9, 2016 5:30 PM, "Vladimir Dubrovin via mailop" 
> wrote:
>
> 25.11.2016 22:50, Al Iverson пишет:
>
> Hi Otto,
>
> Long time no talk. Hope things are going well.
>
> The Spam Cannibal maintainer is a reasonable guy. He doesn't spread
> his contact info far and wide, perhaps because he doesn't want to
> argue with spammers. So, I would feel bad about sharing his details
> publicly. But I will forward your post to him and invite him to follow
> up with you. Hope that helps.
>
>
> I really doubt it. This reasonable guys blacklisted our (Mail.Ru) front
> servers due to same reason ('Generic PTR'). Yes, we have few hundreds of
> front servers, because we host >50% of mailboxes for russian-speaking users
> so we need to count our servers somehow. If you use Spamcannibal you will
> probably have deliverability problems.
>
>
>
> Best regards,
> Al Iverson
>
> --
> Al Iversonwww.aliverson.com(312)725-0130 <(312)%20725-0130>
>
>
> On Fri, Nov 25, 2016 at 8:14 AM, Otto J. Makela   
> wrote:
>
> Sending this to a couple of secret societies, apologies if you see this twice.
>
> Is there any point in trying to contact Spamcannibal?
>
> One of our clients (we're the Finnish NREN, so an university in Finland)
> was notified via Shadowserver that a swathe of their unused IP space is
> listed on Spamcannibal:
> https://www.shadowserver.org/wiki/pmwiki.php/Services/Blacklist
>
> Since the network in question has no assigned addresses, there are no DNS
> records for it. We suspect that the netblock was momentarily snatched from
> them via BGP (or some other routing trick) and then used to send spam.
> We'd really like to know more, like get spamples or at least time stamps.
>
> When I tried to get in touch with Spamcannibal about one IP address via
> their contact form, submitting the form resulted in the glib message:
>
> xxx.xxx.xxx.xxx not eligible for removal: GENERIC PTR
>
> So, anyone know if the form went through, does someone have a contact there,
> and is there any point in doing so?
>
> --
>/* * * Otto J. Makela   * * * * * * * * * */
>   /* Phone: +358 40 765 5772, ICBM: N 60 10' E 24 55' */
>  /* Mail: Mechelininkatu 26 B 27,  FI-00100 Helsinki */
> /* * * Computers Rule 0100 01001011 * * * * * * */
>
> ___
> mailop mailing 
> listmailop@mailop.orghttps://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
> ___
> mailop mailing 
> listmailop@mailop.orghttps://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
>
> --
> Vladimir Dubrovin
> [image: @Mail.Ru]
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Storing 821 envelope recipients in an 822.Header?

[Bill Cole]

On 6 Dec 2016, at 22:40, John Levine wrote:

In article <5ef35d60-7f27-4b35-b2e8-53a20aa61...@blighty.com> you 
write:
I know there's no standard header for storing the envelope recipients 
for a message (for good reason, especially

when it comes to Bccs) but there are times when it's useful.

Does anyone know of a system that does that? I'm stashing them in 
"X-Rcpt-To" at the moment, for lack of anything
better, but if there's even a marginal ad-hoc standard for it I'd 
like to be consistent.


Oh, and some MTAs put them in Delivered-To: lines at the top of the 
message, after

the Return-Path:.


Technically I believe that is usually the final delivery address, after 
local rewrite/de-tag/alias transformations, NOT the original sender 
envelope. For example, my Postfix config adds these headers above its 
Received header for mail from this list:


Return-Path: 
X-Original-To: mailop-20160...@billmail.scconsult.com
Delivered-To: real.u...@hostname.not.exposed.in.public.scconsult.com

The X-Original-To address goes through 2 transformations to become the 
Delivered-To address, which wouldn't work for a non-local SMTP sender in 
any case.


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Storing 821 envelope recipients in an 822.Header?

[Bill Cole]

On 7 Dec 2016, at 5:08, David Hofstee wrote:

> The X- type headers are deprecated... https://tools.ietf.org/html/rfc6648

Not entirely:

   This document generalizes from the experience of the email and SIP
   communities by doing the following:

   [...]
   4.  Makes no recommendation as to whether existing "X-" parameters
   ought to remain in use or be migrated to a format without the
   "X-"; this is a matter for the creators or maintainers of those
   parameters.


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Spamcannibal?

[Gil Bahat via mailop]

+1 unreasonable for an indiscriminate block on all of Amazon SES. Why would
anyone want to use such a BL is beyond me given that there are many, much
better alternatives.

On Dec 9, 2016 5:30 PM, "Vladimir Dubrovin via mailop" 
wrote:

25.11.2016 22:50, Al Iverson пишет:

Hi Otto,

Long time no talk. Hope things are going well.

The Spam Cannibal maintainer is a reasonable guy. He doesn't spread
his contact info far and wide, perhaps because he doesn't want to
argue with spammers. So, I would feel bad about sharing his details
publicly. But I will forward your post to him and invite him to follow
up with you. Hope that helps.


I really doubt it. This reasonable guys blacklisted our (Mail.Ru) front
servers due to same reason ('Generic PTR'). Yes, we have few hundreds of
front servers, because we host >50% of mailboxes for russian-speaking users
so we need to count our servers somehow. If you use Spamcannibal you will
probably have deliverability problems.





Best regards,
Al Iverson

--
Al Iversonwww.aliverson.com
(312)725-0130


On Fri, Nov 25, 2016 at 8:14 AM, Otto J. Makela   
wrote:

Sending this to a couple of secret societies, apologies if you see this twice.

Is there any point in trying to contact Spamcannibal?

One of our clients (we're the Finnish NREN, so an university in Finland)
was notified via Shadowserver that a swathe of their unused IP space is
listed on Spamcannibal:
https://www.shadowserver.org/wiki/pmwiki.php/Services/Blacklist

Since the network in question has no assigned addresses, there are no DNS
records for it. We suspect that the netblock was momentarily snatched from
them via BGP (or some other routing trick) and then used to send spam.
We'd really like to know more, like get spamples or at least time stamps.

When I tried to get in touch with Spamcannibal about one IP address via
their contact form, submitting the form resulted in the glib message:

xxx.xxx.xxx.xxx not eligible for removal: GENERIC PTR

So, anyone know if the form went through, does someone have a contact there,
and is there any point in doing so?

--
   /* * * Otto J. Makela   * * * * * * * * * */
  /* Phone: +358 40 765 5772, ICBM: N 60 10' E 24 55' */
 /* Mail: Mechelininkatu 26 B 27,  FI-00100 Helsinki */
/* * * Computers Rule 0100 01001011 * * * * * * */

___
mailop mailing 
listmailop@mailop.orghttps://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


___
mailop mailing 
listmailop@mailop.orghttps://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop



-- 
Vladimir Dubrovin
[image: @Mail.Ru]

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Spamcannibal?

[Vladimir Dubrovin via mailop]

25.11.2016 22:50, Al Iverson пишет:
> Hi Otto,
>
> Long time no talk. Hope things are going well.
>
> The Spam Cannibal maintainer is a reasonable guy. He doesn't spread
> his contact info far and wide, perhaps because he doesn't want to
> argue with spammers. So, I would feel bad about sharing his details
> publicly. But I will forward your post to him and invite him to follow
> up with you. Hope that helps.

I really doubt it. This reasonable guys blacklisted our (Mail.Ru) front
servers due to same reason ('Generic PTR'). Yes, we have few hundreds of
front servers, because we host >50% of mailboxes for russian-speaking
users so we need to count our servers somehow. If you use Spamcannibal
you will probably have deliverability problems.


>
> Best regards,
> Al Iverson
>
> --
> Al Iverson
> www.aliverson.com
> (312)725-0130
>
>
> On Fri, Nov 25, 2016 at 8:14 AM, Otto J. Makela  wrote:
>> Sending this to a couple of secret societies, apologies if you see this 
>> twice.
>>
>> Is there any point in trying to contact Spamcannibal?
>>
>> One of our clients (we're the Finnish NREN, so an university in Finland)
>> was notified via Shadowserver that a swathe of their unused IP space is
>> listed on Spamcannibal:
>>
>> https://www.shadowserver.org/wiki/pmwiki.php/Services/Blacklist
>>
>> Since the network in question has no assigned addresses, there are no DNS
>> records for it. We suspect that the netblock was momentarily snatched from
>> them via BGP (or some other routing trick) and then used to send spam.
>> We'd really like to know more, like get spamples or at least time stamps.
>>
>> When I tried to get in touch with Spamcannibal about one IP address via
>> their contact form, submitting the form resulted in the glib message:
>>
>> xxx.xxx.xxx.xxx not eligible for removal: GENERIC PTR
>>
>> So, anyone know if the form went through, does someone have a contact there,
>> and is there any point in doing so?
>>
>> --
>>/* * * Otto J. Makela  * * * * * * * * * */
>>   /* Phone: +358 40 765 5772, ICBM: N 60 10' E 24 55' */
>>  /* Mail: Mechelininkatu 26 B 27,  FI-00100 Helsinki */
>> /* * * Computers Rule 0100 01001011 * * * * * * */
>>
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


-- 
Vladimir Dubrovin
@Mail.Ru
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop