[mailop] Google sending IPs/SPF confusion

2023-03-04 Thread MRob via mailop
Hello! lately we had some website hacking breakin and bots being used to proxying abuse, etc. For to fight the abuse gathered IP addrs from server logs many of which including Google IP address ranges. I have to firewall bot and other bad IPs but dont want to firewall Gmail sending IPs. My

Re: [mailop] Intuit directly spaming

2023-03-04 Thread MRob via mailop
On 2023-02-27 23:53, Atro Tossavainen via mailop wrote: > harder to give due suspision on sendgrid because they give full It's actually kind of easy. Is the IP announced by AS11377? Yes? -> SendGrid. Thanks you Atro, is there popular tool for to do that in real time?

[mailop] Google groups spam

2023-02-15 Thread MRob via mailop
Forgive if its already been discused but is googel already aware of ongoing Google Groups spam? Will they stop this? Lots of recurring mails with arabic subject and body from nonsense group names like "hghgjhghjgb": hghgjhghjgb+@googlegroups.com ___

[mailop] Microsoft postmaster/delist request?

2023-02-02 Thread MRob via mailop
Hello, In the past when I had server which got on Microsoft internal blocklist you could follow the link provided in the reject msg to find a postmaster form to request de-list after cleanup of problems. I think the link was on this page

[mailop] Google Translate provide spammer and phishing reputation

2022-11-10 Thread MRob via mailop
Recent I saw a link in a spam which wanted to phish credential: https://translate.google.com/translate?sl=auto=en=en=ipfs.io/ipfs//index.html?submit=@=webapp Google translate shows a live page the user can input data into so effectively google is hosting the payload for the spammer? (indirect

Re: [mailop] [External] Re: Try to understand *.onmicrosoft.com

2022-11-09 Thread MRob via mailop
*From:* mailop on behalf of MRob via mailop *Sent:* Wednesday, November 9, 2022 5:17:09 AM *To:* mailop@mailop.org *Subject:* [mailop] Try to understand *.onmicrosoft.com Is envelope sender user@.onmicrosoft.com normal in non-spam

Re: [mailop] Microsoft allows free-form spoofing?

2022-11-09 Thread MRob via mailop
On 2022-11-09 13:37, Bill Cole via mailop wrote: On 2022-11-09 at 06:47:55 UTC-0500 (Wed, 09 Nov 2022 11:47:55 +) MRob via mailop is rumored to have said: On 2022-11-09 08:40, Slavko via mailop wrote: Dňa 9. 11. o 0:34 MRob via mailop napísal(a): ... But if microsoft agree to DKIM-sign

Re: [mailop] Microsoft allows free-form spoofing?

2022-11-09 Thread MRob via mailop
On 2022-11-09 08:40, Slavko via mailop wrote: Dňa 9. 11. o 0:34 MRob via mailop napísal(a): ... But if microsoft agree to DKIM-sign using envelope-from (**signature including the FROM header**) shouldnt that mean it is seeing the headers and can of course validate FROM header? For me

Re: [mailop] Microsoft allows free-form spoofing?

2022-11-08 Thread MRob via mailop
On 2022-11-08 23:55, Brandon Long wrote: On Tue, Nov 8, 2022 at 3:45 PM MRob via mailop wrote: On 2022-11-08 22:51, Brandon Long via mailop wrote: > Validating From headers is the whole thing behind DMARC. Yes, an MSP > should validate the From header for mail it orig

[mailop] Try to understand *.onmicrosoft.com

2022-11-08 Thread MRob via mailop
Is envelope sender user@.onmicrosoft.com normal in non-spam mail? Is it how all microsoft mail comes through? Or is it usually spam from badly configured domain? Should part *always* match sender domain in FROM header? On the other hand, if mail come from microsoft server *not* through

Re: [mailop] Microsoft allows free-form spoofing?

2022-11-08 Thread MRob via mailop
t-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=. On Tue, Nov 8, 2022 at 2:39 PM MRob via mailop wrote: Hello, Microsoft doesn't limit FROM header spoof? I saw message like: Envelope from: example.user207@.onmicrosoft.com To: From: support@ For example

[mailop] Why no envelope sender in RECEIVED?

2022-11-08 Thread MRob via mailop
Hello, Why isnt it standard to put the envelope sender into the RECEIVED header? Does any MTA do it? ___ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop

[mailop] Microsoft allows free-form spoofing?

2022-11-08 Thread MRob via mailop
Hello, Microsoft doesn't limit FROM header spoof? I saw message like: Envelope from: example.user207@.onmicrosoft.com To: From: support@ For example if TO=rob...@example.com then FROM=supp...@robert.com Is too complicated for microsoft check the FROM header belong to the senders account?

[mailop] Haraka status? Exim the only choice? (v Postfix)

2021-04-30 Thread MRob via mailop
Hi -- I used Postfix along time but my experience is that it is incredible difficult to implement custom logic especially across the different binaries/processes it uses to fulfil a mail delivery transaction. Its designed in the "unix philosophy" and has good performance - great but Postfix

Re: [mailop] Which are legitimate Yahoo mail servers?

2019-05-23 Thread MRob via mailop
://ipv4info.com/org/s8dcb53/IRT-YAHOO-AP.html https://wq.apnic.net/static/search.html Your system, your drop rules :-) On Thu, 23 May 2019 at 18:10, MRob via mailop wrote: In logs I see a large amount spam from servers like sonic303-21.consmr.mail.sg3.yahoo.com [1] ..this looks like it could

[mailop] Which are legitimate Yahoo mail servers?

2019-05-23 Thread MRob via mailop
In logs I see a large amount spam from servers like sonic303-21.consmr.mail.sg3.yahoo.com ..this looks like it could be a home DSL location but before I ban all of sg3.yahoo.com I would like to ask, where does valid Yahoo mail come from? ___