Re: [LINK] Question re spoofing with bad reply address

2014-07-11 Thread Kim Holburn
I run a mail gateway. It is a pain these days. Many people find it easier to outsource email to experts. You have to constantly keep up with the latest things spammers are doing. I use a bunch of techniques but you can't bounce emails. Rarely have I had issues with SPF, only when someone ha

Re: [LINK] Question re spoofing with bad reply address

2014-07-11 Thread David Boxall
To sum up: SPF is one of those cases where geeks will talk among themselves and nobody else will notice. -- David Boxall| Any given program, | when running correctly, http://david.boxall.id.au | is obsolete.

Re: [LINK] Question re spoofing with bad reply address

2014-07-11 Thread Jeremy Visser
On 11/07/14 15:44, Hamish Moffatt wrote: > Why anonymous - can't you require them to STARTTLS+AUTH, even on port 25? Some people have their head in the sand and continue to purchase equipment that doesn't support TLS nor SMTP authentication. And proceed to blame me when it doesn't work. I'd te

Re: [LINK] Question re spoofing with bad reply address

2014-07-11 Thread Stephen Rothwell
Hi, On Fri, 11 Jul 2014 17:05:35 +1000 Stephen Rothwell wrote: > > And some clients don't seem to have even heard of port 587 - STARTTLS > was only originally codified in 1998, made a draft standard in 2006 and > standardised in 2011. Imagine using such new fangled stuff! :-) Let me clarify th

Re: [LINK] Question re spoofing with bad reply address

2014-07-11 Thread Stephen Rothwell
Hi Jeremy, On Fri, 11 Jul 2014 15:35:54 +1000 Jeremy Visser wrote: > > On 11/07/14 14:27, Stephen Rothwell wrote: > > Well, if for no other reason than that many ISPs insist that you use > > their mail server for outgoing email > > Who does this? I would invite you to name-and-shame them. > >

Re: [LINK] Question re spoofing with bad reply address

2014-07-10 Thread Hamish Moffatt
On 11/07/14 15:35, Jeremy Visser wrote: > On 11/07/14 14:27, Stephen Rothwell wrote: >> Well, if for no other reason than that many ISPs insist that you use >> their mail server for outgoing email > Who does this? I would invite you to name-and-shame them. > > But before you do so, check that you

Re: [LINK] Question re spoofing with bad reply address

2014-07-10 Thread Jeremy Visser
On 11/07/14 14:27, Stephen Rothwell wrote: > Well, if for no other reason than that many ISPs insist that you use > their mail server for outgoing email Who does this? I would invite you to name-and-shame them. But before you do so, check that you are sending outbound as port 587 (STARTTLS) or

Re: [LINK] Question re spoofing with bad reply address

2014-07-10 Thread Stephen Rothwell
Hi Hamish, On Wed, 09 Jul 2014 17:55:27 +1000 Hamish Moffatt wrote: > > > It also doesn't help for those with email addresses in domains that > > other people using the same domain post from lots of different places. > > (e.g. other members of my family use various ISP's outgoing mail > > servers

Re: [LINK] Question re spoofing with bad reply address

2014-07-10 Thread Stephen Rothwell
Hi Jeremy, On Fri, 11 Jul 2014 11:59:45 +1000 Jeremy Visser wrote: > > On 09/07/14 17:35, Stephen Rothwell wrote: > > SPF is broken by design (consider forwarding - including mailing > > lists). > > That’s because you’re forwarding incorrectly. SPF validation is done based > on the envelope, n

Re: [LINK] Question re spoofing with bad reply address

2014-07-10 Thread Jeremy Visser
Hi Stephen, On 09/07/14 17:35, Stephen Rothwell wrote: > SPF is broken by design (consider forwarding - including mailing > lists). That’s because you’re forwarding incorrectly. SPF validation is done based on the envelope, not the To/From headers, and all good mailing list software will fix

Re: [LINK] Question re spoofing with bad reply address

2014-07-09 Thread David Boxall
On 9/07/2014 5:27 PM, Hamish Moffatt wrote: ... > Consider implementing SPF ... That cure is worse than the disease. -- David Boxall| Perfection is achieved, not when | there is nothing more to add, but http://david.boxall.id.au | when

Re: [LINK] Question re spoofing with bad reply address

2014-07-09 Thread Kim Holburn
On 2014/Jul/09, at 4:44 PM, JanW wrote: > Bottom line: the internet is still filled with idiots. > > got it That's why spammers. They still get bites. Send a million spams, get a bite, profit. Kim -- Kim Holburn IT Network & Security Consultant T: +61 2 61402408 M: +61 404072753 mailto:k.

Re: [LINK] Question re spoofing with bad reply address

2014-07-09 Thread Hamish Moffatt
On 09/07/14 17:35, Stephen Rothwell wrote: > Hi Hamish, > > On Wed, 09 Jul 2014 17:27:08 +1000 Hamish Moffatt wrote: >> Consider implementing SPF to prevent this. >> http://en.wikipedia.org/wiki/Sender_Policy_Framework >> >> In summary, through the DNS you publish a list of all servers authorised

Re: [LINK] Question re spoofing with bad reply address

2014-07-09 Thread Stephen Rothwell
Hi Hamish, On Wed, 09 Jul 2014 17:27:08 +1000 Hamish Moffatt wrote: > > Consider implementing SPF to prevent this. > http://en.wikipedia.org/wiki/Sender_Policy_Framework > > In summary, through the DNS you publish a list of all servers authorised > to send mail from your domain, and how strict

Re: [LINK] Question re spoofing with bad reply address

2014-07-09 Thread Hamish Moffatt
On 09/07/14 16:35, Karl Auer wrote: > If you are asking why the sender address used was yours, it is for > several reasons: Spammers like to use real sender addresses, because > they are less likely to be identified as spammy senders. Also, the > backscatter (such as the bounces you received, or th

Re: [LINK] Question re spoofing with bad reply address

2014-07-09 Thread Stephen Rothwell
Hi Karl, On Wed, 09 Jul 2014 16:58:06 +1000 Karl Auer wrote: > > On Wed, 2014-07-09 at 16:44 +1000, JanW wrote: > > What is interesting is that when this happens, I seldom get any > > complaints to me about the original email, so at least that's > > something positive. I just get the mailbox fu

Re: [LINK] Question re spoofing with bad reply address

2014-07-08 Thread Karl Auer
On Wed, 2014-07-09 at 16:44 +1000, JanW wrote: > What is interesting is that when this happens, I seldom get any > complaints to me about the original email, so at least that's > something positive. I just get the mailbox full, dead address results. You'll only ever get a complaint if the spam a

Re: [LINK] Question re spoofing with bad reply address

2014-07-08 Thread JanW
At 04:35 PM 9/07/2014, Karl Auer you wrote: >It's because spammers now routinely use other people's addresses as the >sending addresses that getting mad at the apparent sender is pointless. >The apparent sender is almost certainly not the actual sender. Thanks. Makes perfect sense now. Bottom lin

Re: [LINK] Question re spoofing with bad reply address

2014-07-08 Thread Karl Auer
On Wed, 2014-07-09 at 16:04 +1000, Jan Whitaker wrote: > I've had two email returned advisories where my address has been > spoofed (see below). > I can't figure out the the motivation for this. There was an embedded > link in the message (no I didn't click on it), but the whole email > aspect i

[LINK] Question re spoofing with bad reply address

2014-07-08 Thread Jan Whitaker
I've had two email returned advisories where my address has been spoofed (see below). I can't figure out the the motivation for this. There was an embedded link in the message (no I didn't click on it), but the whole email aspect is fake. What is the payoff to the sender? Jan pS: I did have my