[Declude.JunkMail] FW: You **MAY** have spam
sigh This is legit, coming from my own mailserver, and it failed the SPF test. Obviously something is not correct here. Any suggestions? I have used the wizard on the pobox site and pasted the text string into a text record in my DNS. I've had to disable the test for now as all my legit mail is being flagged as spam. Sharyn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Declude JunkMail Sent: Wednesday, June 30, 2004 8:17 AM To: [EMAIL PROTECTED] Subject: You **MAY** have spam You **MAY** have spam! Subject:New Directory From: [EMAIL PROTECTED] Tests Failed: 11-CMDSPACE, SPFFAIL, WEIGHT10-Daf1a0221059a2e33.SMD To view the E-mail, just click the attachment. ---BeginMessage--- Title: New Directory Attached is the new company for the Lake Alfred, Winter haven, and Auburndale facilities. Should any changes need to be made please let me know. ... Thank You Kay E Ext 161 ---End Message---
Re: [Declude.JunkMail] FW: You **MAY** have spam
This is legit, coming from my own mailserver, and it failed the SPF test. Obviously something is not correct here. Any suggestions? I have used the wizard on the pobox site and pasted the text string into a text record in my DNS. The problem is that your SPF record (v=spf1 a mx ptr -all) doesn't list IPs that your users may be connecting to your mailserver from. In this case, you should whitelist your own users (WHITELIST AUTH if you are running IMail v8 and the latest Declude beta). -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: FW: [Declude.JunkMail] FW: You **MAY** have spam
I believe that both CMDSPACE and SPF are inappropriate tests to score unless you can whitelist your own local users that connect directly to your server to send E-mail. If you have IMail 7 and your users are on IP space that you don't control, you are out of luck, but if you have either IMail 8 and/or all of your users connect by way of a LAN, then there are ways to do this, but you should first indicate which of the above applies. Matt Sharyn Schmidt wrote: UPDATE: ALL my legit todhunter mail is coming as spam LOL what else can one do but laugh??? Sharyn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Sharyn Schmidt Sent: Wednesday, June 30, 2004 8:33 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] FW: You **MAY** have spam sigh This is legit, coming from my own mailserver, and it failed the SPF test. Obviously something is not correct here. Any suggestions? I have used the wizard on the pobox site and pasted the text string into a text record in my DNS. I've had to disable the test for now as all my legit mail is being flagged as spam. Sharyn -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Declude JunkMail Sent: Wednesday, June 30, 2004 8:17 AM To: [EMAIL PROTECTED] Subject: You **MAY** have spam You **MAY** have spam! Subject: New Directory From: [EMAIL PROTECTED] Tests Failed: 11-CMDSPACE, SPFFAIL, WEIGHT10-Daf1a0221059a2e33.SMD To view the E-mail, just click the attachment. Subject: New Directory From: "Kay Evanson" [EMAIL PROTECTED] Date: Wed, 30 Jun 2004 08:16:58 -0400 To: [EMAIL PROTECTED] New Directory Attached is the new company for the Lake Alfred, Winter haven, and Auburndale facilities. Should any changes need to be made please let me know. ... Thank You Kay E Ext 161 -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =
RE: [Declude.JunkMail] FW: You **MAY** have spam
The problem is that your SPF record (v=spf1 a mx ptr -all) doesn't list IPs that your users may be connecting to your mailserver from. The problem may also be that ID 10 T error and I never listed the IP of my firewall, which uses an SMTP proxy. (Len is laughing if he is reading this) In this case, you should whitelist your own users (WHITELIST AUTH if you are running IMail v8 and the latest Declude beta). Im only running IMAIL 7.15. I have made the change in the SPF record in DNS, listing my firewall's IP. Is there a way to test this before I turn everything back on? I've already had to send out an email to the entire company explaining that I futzed up, don't want to have to do this again. LOL Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) htmla href=http://www.cruzanrums.com;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FW: You **MAY** have spam
Ok.. Does this mean things are working now? I just ran the test on Scott's website... SPF lookup of sender [EMAIL PROTECTED] from IP 24.73.160.162: SPF string used: v=spf1 ip4:24.73.160.162 a mx ptr -all. Processing SPF string: v=spf1 ip4:24.73.160.162 a mx ptr -all. Testing 'ip4:24.73.160.162' on IP=24.73.160.162, target domain 24.73.160.162, CIDR 32, default=PASS. MATCH! Testing 'a' on IP=24.73.160.162, target domain example.com, CIDR 32, default=PASS. Testing 'mx' on IP=24.73.160.162, target domain example.com, CIDR 32, default=PASS. Testing 'ptr' on IP=24.73.160.162, target domain example.com, CIDR 32, default=PASS. Testing 'all' on IP=24.73.160.162, target domain example.com, CIDR 32, default=FAIL. Result: PASS This, however, is no guarrantee things are going to work internally though, is it? snip from Matt's email believe that both CMDSPACE and SPF are inappropriate tests to score unless you can whitelist your own local users that connect directly to your server to send E-mail. If you have IMail 7 and your users are on IP space that you don't control, you are out of luck, but if you have either IMail 8 and/or all of your users connect by way of a LAN, then there are ways to do this, but you should first indicate which of the above applies. I control all the IPS my users are on, it's a local LAN...192.168.x.x (there are 5 different subnets) but my mail server is on a DMZ off the firewall, and I have an smtp proxy enabled. This would indicate that in reality, it's the IP address of the firewall that is actually handling the internal mail, as well. So, adding the IP address of the firewall (24.73.160.162) should work. I wish there was a way to test this internally. Is there? Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) htmla href=http://www.cruzanrums.com;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FW: You **MAY** have spam
I lowered the weight of the spf fail weight to 1 (warn in headers) to test this internally. My internal IPs are still failing the spf test. How do I go about whitelisting 5 subnets of internal IP addresses with IMAIL 7.15? It's probably not a bad idea anyway, if it's possible, as everything internally is failing the cmdspace test too. Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) htmla href=http://www.cruzanrums.com;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FW: You **MAY** have spam
Sharyn Schmidt wrote: I control all the IPS my users are on, it's a local LAN...192.168.x.x (there are 5 different subnets) but my mail server is on a DMZ off the firewall, and I have an smtp proxy enabled. This would indicate that in reality, it's the IP address of the firewall that is actually handling the internal mail, as well. So, adding the IP address of the firewall (24.73.160.162) should work. Chances are that you need to IPBYPASS the firewall's IP in your global.cfg and then whitelist your LAN by it's IP space. The SPF record should reflect the last IP of your network before it hits the receiving server. This will cure your CMDSPACE issue as well. I say chances are because I'm not sure that all of the relevant information was shared. Matt -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] FW: You **MAY** have spam
Chances are that you need to IPBYPASS the firewall's IP in your global.cfg and then whitelist your LAN by it's IP space. Do I have to list each individual address separately (will put it at over 200 addresses so this won't work) or can I use a /24 notation for each subnet block? Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) htmla href=http://www.cruzanrums.com;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] FW: You **MAY** have spam
CIDR ranges do work. I believe the manual contains examples of this. For example: IPBYPASS24.73.160.162 WHITELISTIP 192.168.0.1/24 Just to be clear on the conditions present, the whitelisting won't work if you have users that connect directly (or through your firewall when IPBYPASS'ed) from other networks. For example, a user that is connecting from home using their own broadband connection to send E-mail directly to your SMTP server will not be whitelisted using this method, and this would also result in them failing SPF under this setup, and might fail CMDSPACE. If you have remote users like this, the suggested fix won't work as desired and if you are running IMail 7 and not IMail 8, both SPF and CMDSPACE are probably inappropriate (you can add WHITELIST AUTH to your global.cfg with IMail 8 that will take care of this problem, but this won't work with IMail 7). Matt Sharyn Schmidt wrote: Chances are that you need to IPBYPASS the firewall's IP in your global.cfg and then whitelist your LAN by it's IP space. Do I have to list each individual address separately (will put it at over 200 addresses so this won't work) or can I use a /24 notation for each subnet block? Sharyn We are the worldwide producer and marketer of the award winning Cruzan Single Barrel Rum, judged Best in the World at the annual San Francisco Wine and Spirits Championships. For more information, please click (go to) htmla href=http://www.cruzanrums.com;www.cruzanrums.com/a/html --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. -- = MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ = --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
