Re: [mailop] Many SPF failures lately

2017-05-17 Thread John Levine
In article you write: >I hope that bouncing messages from servers not listed in a valid SPF >record isn't controversial. Controversial? Naah. Foolish and self-defeating? Definitely. R's, John ___ mailop mailing list mailop@mailop.org https://chill

Re: [mailop] Speaking of too many SPF, Many SPF failures lately

2017-05-17 Thread John Levine
In article you write: >_spf.google.com is 4 lookups in total). Do you know why? It'd be easy enough to glom them together into one record. It'd be more than 512 bytes but it is my impression that the number of DNS clients that support neither EDNS nor TCP queries is pretty small now. R's, Joh

Re: [mailop] Many SPF failures lately

2017-05-19 Thread John Levine
In article <002401d2d07c$de401730$9ac04590$@iname.com> you write: >I turned on SPF checking on our incoming email server about two or three >months and notified >domain holders who were sending legitimate email from bad IPs, and there, too, >some fixed up >their SPF records, but the majority didn

Re: [mailop] Many SPF failures lately

2017-05-19 Thread John Levine
In article you write: >It might be obvious in this particular case but it isn't in general if >your users asked or agreed to reject SPF-Fails. I would be pretty impressed to find a mail system where the users even knew what SPF fails were, much less agreeing to lose real mail because of them.

Re: [mailop] SPF record

2017-05-20 Thread John Levine
In article <3a8a3db1-a628-4cf5-add5-d2db22b5c...@blighty.com> you write: >"~all" is the smart policy to use; ignore those who tell you to use "-all" or >"?all". Not disagreeing, but what practical difference do you see between ~all softfail and ?all neutral ? R's, John

Re: [mailop] SPF record

2017-05-21 Thread John Levine
In article <100.10d30d0034b32159@comkal.com.au> you write: >Anyone forwards an email I've sent them, then the headers >will specify their sending domain so the SPF record for >my domain should be irrelevant. Good luck with that. R's, John ___ mailo

Re: [mailop] So, about this iOS10 unsubscribe feature...

2017-05-23 Thread John Levine
In article <6898.1495560...@turing-police.cc.vt.edu> you write: >-=-=-=-=-=- >-=-=-=-=-=- > >On Tue, 23 May 2017 09:29:34 -0400, Joey Rutledge said: >> Do you guys have any samples of the invalid Unsubscribe headers? There is a >> newish spec (RFC8058; https://tools.ietf.org/html/rfc8058) that I’v

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread John Levine
In article <1495815209.2586.28.ca...@wemonitoremail.com> you write: >Any suggestions would be very welcome as long they don't involve swapping >out sendmail or Evolution! Put a shim between Evolution and sendmail so you can see what it's sending, and how sendmail rewrote it. From what you said, t

Re: [mailop] dkim signature failures sendmail/opendkim

2017-05-26 Thread John Levine
In article <1495829062.1095.13.ca...@mailman-hosting.com> you write: >On Fri, 2017-05-26 at 17:13 +0100, Ken O'Driscoll wrote: >> Any suggestions would be very welcome as long they don't involve >> swapping out sendmail or Evolution! What is the order of operations. This is likely to break: Evol

Re: [mailop] DMARC forensic reports

2017-06-08 Thread John Levine
In article you write: >Is there a way to find out / determine who is sending DMARC forensic reports? Other than sending broken DMARC and seeing who reports back (as noted, mailing lists are a good start) I'm not aware of any. If people want, I can make a summary of the addresses that have sent t

Re: [mailop] DMARC forensic reports

2017-06-08 Thread John Levine
In article <55507ff5-0daf-41a9-9c5e-093b23805...@wordtothewise.com> you write: >> If people want, I can make a summary of the addresses that have sent >> them to me and we can swap them around. I have about 62000 reports. > >Sounds like work. But if the list gets generated, I’ll take a copy :) He

Re: [mailop] DMARC forensic reports

2017-06-08 Thread John Levine
In article you write: >You mean something like this (2,850 entries): > >https://dmarcian.com/dmarc-status/ No, that's XML aggregate reports. R's, John ___ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mail

Re: [mailop] DMARC forensic reports

2017-06-08 Thread John Levine
In article <9bd40d9d-1c4f-4859-8169-d270d2811...@wordtothewise.com> you write: >> https://dmarcian.com/dmarc-status/ > >That doesn’t distinguish between forensic and summary reports, I don’t think. >It just says “XML” Aggregate reports are XML, forensic repor

Re: [mailop] What are "printing ASCII characters" RFC 850/2822 (was: Re: Lotus Notes and "250 2.6.0 Bad message, but will be delivered anyway"))

2017-06-09 Thread John Levine
In article <20170609162256.3e4e5...@go.imp.ch> you write: >The problem is that apparently lotus notes uses the § character in the >Message-ID and amavis complains about it being an unencoded 8-bit >character. Amavis is right. The standard for ASCII is RFC 20, and it's definitely a seven-bit code.

[mailop] Endless spam blowback from Microsoft Office 365

2017-06-21 Thread John Levine
I'm seeing lots and lots of spam blowback from O365, helpful and informative messages telling nonexistent forged addresses here that it couldn't deliver obvious spam. I don't get these from anyone else; Microsoft is uniquely good (bad) both at not identifying the spam, and at sending back NDRs rat

Re: [mailop] Endless spam blowback from Microsoft Office 365

2017-06-21 Thread John Levine
In article <73ccc236-9386-4e72-ba60-84ec7df03...@graemef.net> you write: >I suspect you’re on the receiving end of hybrid installations, where O365 is >logically the either the back end >(most common) or front end (not so common) of a multi-layer stack involving, >potentially, on-site MX >servers

Re: [mailop] btinternet.com blacklist

2017-07-10 Thread John Levine
In article <34c9f2de-c6bf-69af-6570-f17b3f283...@latter.org> you write: >We have been in the Hetzner "neighbourhood" for years. This is our >fourth server (and hence IP address) there and the first time we have >had this issue. [1] Honestly, you're lucky. Hetzner gushes spam, and I've had most o

Re: [mailop] btinternet.com blacklist

2017-07-10 Thread John Levine
In article <6dc1c120-5c8d-3d83-fdfc-c520f5c05...@schwarz.eu> you write: >What puzzles me most is that I'm not sure how providers like Hetzner are >supposed to reduce their spam rate significantly. Hetzner is an outlier, and not in a good way. Many other hosting companies manage to control their

Re: [mailop] hetzner and the btinternet.com blacklist

2017-07-11 Thread John Levine
In article <9cdac510-4000-56f3-f919-8c5f1edaf...@schwarz.eu> you write: > >Am 10.07.2017 um 21:45 schrieb John Levine: >> Many other hosting companies manage to control their spam. The usual >> approach is to filter the mail their customers send, either with >> &

Re: [mailop] hetzner and the btinternet.com blacklist

2017-07-11 Thread John Levine
In article <1499809822.14353.11.ca...@ns.five-ten-sg.com> you write: >> Doesn't matter -- the "transparent" filters force all of the >> connections to the provider's filtering host, so if there's a TLS >> connection, it terminates at the filtering host. > >That sort of proxy will break some of your

Re: [mailop] User question about getting off blocklists

2017-07-12 Thread John Levine
In article <01ef01d2fb31$bf07bb90$3d1732b0$@bonackers.com> you write: >What authority is required to make a request for removal from a block >list? Once the problem is fixed, it usually doesn't matter who asks to have the block removed. For that matter, if the problem hasn't been fixed, it usuall

Re: [mailop] btinternet.com blacklist

2017-07-12 Thread John Levine
In article you write: >I do still find it baffling that guilt by association [1] is considered >reasonable - and I do not see the need to block ranges when single >IPs will do. Although perhaps there are technical reasons for this >that I am unaware of. I get the impression that you vastly overe

Re: [mailop] btinternet.com blacklist

2017-07-13 Thread John Levine
In article you write: >For example the top 50 ips from 78.47.0.0/16 (by email volume) there were 34 >IPs with "good" reputation and 7 with "bad" reputation. Some of us keep our own records of what arrives at our mail servers. For the past couple of months from 78.47/16 I see one message from you

Re: [mailop] self-signed cert for inbound TLS

2017-07-28 Thread John Levine
In article <808816365.710.1501249729...@appsuite.open-xchange.com> you write: >> The practical reason is that unencrypted SMTP has to work if you want to >> be able to communicate with the world. ... >This, by the way, is another advantage of DANE. By publishing a TLSA record >for the ser

Re: [mailop] self-signed cert for inbound TLS

2017-07-31 Thread John Levine
In article you write: >If someone connects to you, they don't send you a cert unless you're >dealing with client certs, and I don't think >DANE covers that at all, though I haven't read through it completely. The client can present a cert in the TLS handshake if it wants to. Few do and equally f

Re: [mailop] SPF/DMARC and subdomains

2017-08-25 Thread John Levine
In article you write: >The DMARC RFC indicates you can set a policy specific for subdomains [2]. >If sp=reject is set at _dmarc.example.tld (and there isn't an overriding >policy at the host itself, since it gets checked first [3]), would this >would be an effective way to disclaim email coming s

Re: [mailop] dkim bleeding-edge

2017-09-09 Thread John Levine
In article you write: >On 09/09/17 13:38, Bressier Simon wrote: >> sha512 is not yet on the current dkim specification base, is that just a >> test you are doing ? > >This is forward-looking development in view of this draft: > >https://tools.ietf.org/html/draft-srose-dkim-ecc-00 I would suggest

Re: [mailop] dkim bleeding-edge

2017-09-10 Thread John Levine
In article you write: >On 09/09/17 23:34, John Levine wrote: >>> https://tools.ietf.org/html/draft-srose-dkim-ecc-00 >> >> I would suggest reading the dcrup working group's mailing list before >> implementing anything from abandoned drafts. > >How

Re: [mailop] dkim bleeding-edge

2017-09-13 Thread John Levine
In article <1505287717.3810402.1104386920.69118...@webmail.messagingengine.com> you write: >As already mentioned in the CPAN ticket you opened, we are >following dcrup, and will implement the results of that, but >nothing to show as yet. >SHA-512 is an easy update, there is a branch of Mail::DKIM

Re: [mailop] Help with a header.

2017-09-30 Thread John Levine
In article you write: >This is a classic DKIM replay attack, no? It's not an attack. It's just a forwarded message. ___ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] List-Unsubscribe support

2017-10-03 Thread John Levine
In article you write: >*Mail clients* >Outlook >Thunderbird -- requires plugin to support it >Apple iOS -- supports it alpine (don't knock it if you haven't tried it) R's, John ___ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cg

Re: [mailop] unique/shared public DKIM keys per domain?

2017-10-09 Thread John Levine
In article you write: >ISPs might consider the change of s= or key as an element being part of >their reputation systems and metrics. If they do they are egregiously failing to do what the DKIM spec says they should, and I don't know any ISP that does that. Do you? It is crystal clear in the

Re: [mailop] Public Mailop archive?

2017-11-06 Thread John Levine
In article you write: >https://www.mail-archive.com/mailop@mailop.org/ > >All other members, you might want to check this out and make sure >you're comfortable with your messages being published on the web in >this manner. It's rather rude to make an archive without asking permission, but given

Re: [mailop] Comcast Feedback Loop emails that look legitimate

2017-11-07 Thread John Levine
In article <004501d357dd$06151430$123f3c90$@c4.net> you write: >I'm wondering if there are any other actions that trigger a spam report and >consequently a FBL report. IP reputation, message content, 3rd party >antivirus actions, etc. ? I would be pretty surprised if the reason were anything oth

Re: [mailop] Anybody have a pointer to a clued qwet.net mail person?

2017-11-07 Thread John Levine
In article you write: >Or someone can simply remind qwest that 'pipelining' is so 90's... > >We aren't using 2400 baud modems anymore.. > >Pipelining is evil.. IMHO Uh, no. The faster the network, the more difference pipelining makes because the more relative delay each handshake causes. As Ned

Re: [mailop] Gmail forwarding blowback

2017-11-08 Thread John Levine
In article <0c09bad3-14bc-cd51-9bc8-25a205273...@lscg.ucsb.edu> you write: >I wonder if it would ever work to allow a server to forward a message >while including headers that indicate the message had signs of spam. It >would only work in the negative direction (this message is spam, but not >t

Re: [mailop] SPF recommendations

2017-12-14 Thread John Levine
quot;FEAR ME OH INTERNET" in their adorable high squeaky voices. R's, John PS: >How does DMARC fail at forwarding? Please review the previous million or so messages on this topic. -- Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies", Pl

[mailop] IMAP to IMAP

2017-12-15 Thread John Levine
R's, John -- Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. https://jl.ly ___ mailop mailing list mailop@mailop.org https://chilli.nos

Re: [mailop] IMAP to IMAP

2017-12-15 Thread John Levine
their various subfolders. (It's a design firm, they send around a lot of autocad files.) Gmail says they have a 500 MB/day IMAP upload limit, and imapsync will throttle to stay under that limit so a 10 GB mailbox would take three weeks. Really? Ugh. R's, JOhn -- Regards, Joh

[mailop] Tell me about survey monkey

2017-12-26 Thread John Levine
They have a bizarre policy that when you send a spam report in response to one of their survey invitations, they reply and say it's been suppressed *for that user only*. I've gone around with them on this, they insist they have no control over the mail that goes through their servers, then eventua

[mailop] Is BitBounce for real?

2018-01-16 Thread John Levine
Several of the mailing lists I'm on are plagued with mail purporting to be from subscribers but actually from a thing called Bitbounce. Having looked at the Bitbounce website I really can't tell if they're serious or it's an elaborate prank. They combine challenge/response spam "filtering" (a WKB

Re: [mailop] Is BitBounce for real?

2018-01-16 Thread John Levine
In article you write: >On 16 Jan 2018 11:26:07 -0500, "John Levine" wrote: > >>Is this a practical joke? > >One could be forgiven for believing that the prime revenue model is "money >from subscribers to the 'service'". Except that they

Re: [mailop] Is BitBounce for real?

2018-01-16 Thread John Levine
In article <8e893939-3441-9680-c449-4de454e77...@spamtrap.tnetconsulting.net> you write: >-=-=-=-=-=- >-=-=-=-=-=- > >On 01/16/2018 03:09 PM, John R Levine wrote: >> It's so obviously doomed to fail that I can't figure out what their >> angle is. > >I'm guessing that BitBounce will get a nominal

[mailop] Microsoft, your one-stop source for blowback spam

2018-01-17 Thread John Levine
For at least the past week, whenever I look in my spam folder I see lots and lots of blowback spam from outlook.com/O365/whatever. It's all bounces to nonexistent addresses in my domains, telling me that egregiously obvious spam sent with fake From: addresses wasn't delivered. It's gotten a lot w

Re: [mailop] supp...@gmail.com doesn't accept email.

2018-01-20 Thread John Levine
In article you write: >See RFC 2142: "3. BUSINESS-RELATED MAILBOX NAMES > > These names are related to an organization's line-of-business > activities." … > >"SUPPORTCustomer ServiceProblems with product or service" What? Someone didn't perfectly implement a 20 year old RFC? Al

[mailop] Lots of spam from gmail ?

2018-02-02 Thread John Levine
In the past few days I've seen a lot of spam from gmail, sleazy SEO and the like. Has someone cracked their signup system? ___ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

2018-02-02 Thread John Levine
nd that pretty much all of them were caught by the DNSBLs. R's, John -- Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. https://jl.ly ___

[mailop] Any contacts at Mailshell ?

2018-02-05 Thread John Levine
An e-mail provider that should know better (Tucows) says they're blocking mail from me on one of the server clusters because my outgoing IP is listed at Mailshell. If you start here and type in my IP 64.57.183.53, you will indeed get a page that says it has a "moderately spammy reputation" which i

Re: [mailop] Anyone on this list from SpamCop?

2018-02-06 Thread John Levine
In article <7e12d5ff-f770-b5db-f913-18dafcd03...@thedave.ca> you write: >>> Also URLs in mail headers, which is perhaps reasonable, except that >> >> ...many ESPs now put unsub URLs in the headers. > >Are the results any more harmful than the same unsub URL in the foot (or >otherwise in the visib

Re: [mailop] Issues With the way Google Groups unsubscribe is used in headers..

2018-02-07 Thread John Levine
In article you write: >-=-=-=-=-=- >-=-=-=-=-=- > >I'll file a bug. > >And this is a direct message from the list to the one attempting to >unsubscribe? Yes, it's been like that for a long time. R's, John ___ mailop mailing list mailop@mailop.org htt

Re: [mailop] Extreme amounts of SMTP auth from microsoft/outlook IPs

2018-02-09 Thread John Levine
In article you write: >I'm confused, the first post said valid credentials, is that what everyone >else is seeing? > >Nearly all valid creds seems weirder than mostly invalid... modulo whatever >amount of hijacked or reused creds there are. Remember that Outlook does account consolidation like G

Re: [mailop] Extreme amounts of SMTP auth from microsoft/outlook IPs

2018-02-09 Thread John Levine
In article you write: >To me that this smells of mis-using SMTP as an authentication backend. Badly. No, it's probably some bug that makes it think that it has a message to send but it fails and keeps retrying. Once upon a time, I though it would be fun to have a content farm, so I set one up w

mailop@mailop.org

2018-02-14 Thread John Levine
In article <9bd624ba-acfd-7bb0-def0-87b89165a...@keycodes.com> you write: >> Spamhaus lists that IP as a "courtesy SBL listing" -- presumably at the >> request of the IP's owner. Here are other IPs Spamhaus lists as a courtesy: >> >> https://www.spamhaus.org/sbl/listings/courtesy.spamhaus.org > >

Re: [mailop] how pipelining works, Once more: outlook.com services abused for Backscatter DDOS Attacks

2018-02-15 Thread John Levine
In article <98041d34-9657-fbe0-8328-4786ac7e5...@linuxmagic.com> you write: >3.1. Client use of pipelining > >Once the client SMTP has confirmed that support exists for the >pipelining extension, the client SMTP may then elect to transmit >groups of SMTP commands in batches without wai

Re: [mailop] RoadRunner Help?

2018-02-16 Thread John Levine
In article <32db9480-1666-d007-4d83-976d891e2...@linuxmagic.com> you write: >> It's not really wise to use non-obfuscated return paths when using >> VERP. If it's easily decodable, a goofball could spin up fake ones to >> try to get 'em logged as legitimate bounces and inhibit future >> delivery of

Re: [mailop] VERP in 2018 (Was: RoadRunner Help?)

2018-02-17 Thread John Levine
In article you write: >My 2cents: some ISPs require a manual registration based on the MAIL FROM >email address (not just the domain name), >hence VERP can't be used for them. Sounds like an excellent reason to get a less clueless ISP. Long before VERP, we had wildcard names like joe+whate...

Re: [mailop] RoadRunner Help?

2018-02-17 Thread John Levine
In article you write: >I am saying that I think it's unwise to put what amounts to >subscriber-level PII or basically clear identifiers in the Return >Path/MFROM, if mail back to that address is interpreted as an >indication that an action should be taken (like logging a bounce and >potentially s

Re: [mailop] the joys of VERP, was RoadRunner Help?

2018-02-17 Thread John Levine
In article you write: >The use of IDs instead of the real original email in the return-path >may also be because of length limits. >Max length of an email address is 254 chars. If you have to insert it >"almost clear" in a return path and change the domain then there are >chance your return-path

Re: [mailop] VERP in 2018 (Was: RoadRunner Help?)

2018-02-17 Thread John Levine
In article you write: >>>My 2cents: some ISPs require a manual registration based on the MAIL FROM >>>email address (not just the domain name), >>>hence VERP can't be used for them. >> >> Sounds like an excellent reason to get a less clueless ISP. >> >> Long before VERP, we had wildcard names li

Re: [mailop] RoadRunner Help?

2018-02-17 Thread John Levine
In article you write: >Missing the point there. It has nothing to do with knowing the To: >address for a given recipient. If the VERP string fields are just >simple numeric identifiers, a bad actor could send ones with >incremented or otherwise changed numbers to make the bounce handling >system

Re: [mailop] Microsoft IPs automatically unsubscribing recipients?

2018-02-27 Thread John Levine
;t unsubscribe you but it may send you to a confirmation page with an are-you-sure button. If you POST it, you unsubscribe the person. The best known place this is used is the Gmail spam button, which will ask you if you also want to unsubscribe if it sees an unsub link. I gather other webm

[mailop] Looking for Dave Lugo

2018-03-03 Thread John Levine
Does anyone have a current contact for Dave Lugo who I think still works at Comcast? His etherboy.com domain doesn't work, can't ping any of the hosts. R's, John ___ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/lis

Re: [mailop] Microsoft IPs automatically unsubscribing recipients?

2018-03-06 Thread John Levine
In article you write: >I am against scanning everything in order to protect. Because every method >an ESP needs to do to "fix" these bad unsubscribes can just as easily be >spoofed by bad actors (e.g. redirect url to non-malicious content for first >10 minutes). And not all ESPs are even aware of

Re: [mailop] Hat color of list washers / validators

2018-03-07 Thread John Levine
In article <760493287b1f4d1888261519139f3...@infusionsoft.com> you write: >In the worst examples I've seen, the domain went from a legitimate mail server >to a trap network in the same day, with no time for bounces in between. It's hard to believe any BL that anyone actually uses would do that.

Re: [mailop] Hat color of list washers / validators

2018-03-08 Thread John Levine
nd if they had good data scientists they would know that I stopped buying direct when they started selling locally. R's, John -- Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. ht

Re: [mailop] Reg. Instant delivery within sec. for OTP based mailer

2018-03-10 Thread John Levine
In article you write: >We are triggering OTP based mailer where we would expect emails to get >deliver within second from our delivery n/w to reception end. Currently we >are facing latency in terms of delivering emails to Gmail & other public ISP. To rephrase a little: "We have a design that r

Re: [mailop] Rambler.ru 20 seconds connection delay

2018-04-08 Thread John Levine
In article you write: >Hello, > >I see delays in connections to @rambler.ru, with 20 seconds between the >connection and ">>> 220 resmtp1.mail.rambler.ru Ok" > >I guess I'm not the only one, but I don't know if it's the same for everyone, >or if there are "reasons" for that to happen in some

Re: [mailop] question regarding support for international characters

2018-04-09 Thread John Levine
In article you write: >-=-=-=-=-=- >-=-=-=-=-=- >-=-=-=-=-=- > >Hello folks > >I've been tasked with finding out what the general consensus is on the >support in email headers for International characters such as UTF-8 >Charcacters and including things like accented characters like � and � an

Re: [mailop] DMARC with broken DKIM (was: Re: DMARC p=quarantine pct=0)

2018-04-09 Thread John Levine
In article you write: >Sometimes I'm thinking DMARC should have enforced DKIM, and not allowed >to have only a match in {SPF, DKIM}, because it leads to issues like >broken-DKIM working-SPF domains not noticing things are wrong even >though they *are*… That was ADSP. It was even worse than DMARC

Re: [mailop] DMARC with broken DKIM (was: Re: DMARC p=quarantine pct=0)

2018-04-09 Thread John Levine
In article you write: >-=-=-=-=-=- > >We've also seen various banks and other large companies who seem to >specifically only use SPF with DMARC, as a way of disallowing forwarding, I >guess. More likely their mail comes from a lot of places with hostile mail admins, and while the overall admins

Re: [mailop] question regarding support for international characters

2018-04-10 Thread John Levine
In article <20180410083903.gi86...@rincewind.trouble.is> you write: >>>I've been tasked with finding out what the general consensus is on the >>>support in email headers for International characters such as UTF-8 ... >Accented characters in real names are pretty universally accepted >though. E

Re: [mailop] Received header address information

2018-04-21 Thread John Levine
In article you write: >Am I missing a case where there is a negative outcome to a legitimate, >by-the-book sender? Spammer forges header with address of unrelated network, that network gets listed even though it has never sent spam and has no relation to the spammer. R's, John

Re: [mailop] GDPR and WHOIS PRIVACY

2018-05-04 Thread John Levine
In article <83597042-cbe0-4f18-a9bb-ea71d7458...@isipp.com> you write: >Speaking of this sort of stuff, on another (very different) list that I'm on, >someone asked for recommendations for a "top >email data acquisition outfit" (sigh). Then I realized..if even one EU email >address is on an acqu

Re: [mailop] verizon.com Postmaster

2018-05-09 Thread John Levine
In article you write: >I'm curious what your FP rate is on this strict checking of the HELO host >name. I don't believe any of the major inbox providers do it, which should >be a clue it is not very accurate of a signal. It's pretty low. I happen to know that AOL does which is why it's amusing

Re: [mailop] Yahoo DKIM Signing, not folding the header..

2018-05-24 Thread John Levine
In article <88c423e5-1f7b-613e-807e-f519b0636...@linuxmagic.com> you write: >Just want to bring it up, the AOL Dkim header is 520 characters long all >on one line... What leads you to believe that's a problem? The specs have always been very clear that lines in mail messages can be up to 1000 ch

Re: [mailop] Yahoo DKIM Signing, not folding the header..

2018-05-24 Thread John Levine
In article you write: >And there are a lot more things processing email headers that just >software.. 'view source', human readability.. etc. If I had to make a big list of mail issues to worry about this would be so far down you'd need a seismometer to detect it. Messages with f500 character l

Re: [mailop] SpamCannibal RBL

2018-05-30 Thread John Levine
These should have given us a hint: >Registrar Registration Expiration Date: 2018-05-26T19:20:39 >Name Server: ns1.renewyourname.net >Name Server: ns2.renewyourname.net ___ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailm

Re: [mailop] SpamCannibal RBL

2018-05-30 Thread John Levine
In article you write: >I don't see a hint there. That's just a domain name. In theory it could >mean "come back and renew your domain name" but when you go to the website >for the domain, it tries to serve you malware, so it is either a really >yucky registrar or the domain has been newly purchas

Re: [mailop] SpamCannibal RBL

2018-05-31 Thread John Levine
In article you write: >It sure looked malware-like, though. Pushy auto-download attempt, big >full-screen insistence that I install it. Multiple redirects and >landing domain serving this was not recognized. (I suppose it could >have been some sort of CDN domain but I work with them enough that I

Re: [mailop] Should mail servers publish IPv6 MX records? Could this harm your spam filtering?

2018-06-07 Thread John Levine
In article you write: >Isn't the simplest way to handle this is to treat IPv6 at the /64 or >smaller level? That's what Spamhaus does. They made rbldnsd serve v6 CIDRs like it serves v4. Apropos of Steve's comment about blowing caches, I did some simulations a while ago of various ways to publ

Re: [mailop] Should mail servers publish IPv6 MX records? Could this harm your spam filtering?

2018-06-10 Thread John Levine
In article you write: >On Fri, 8 Jun 2018 at 17:53, Michael Peddemors wrote: >> [...] >> And while using that as feedback might seem the logical conclusion, in >> the real world we still see more feedback reports from legitimate email >> the customer should have wanted, vs emails tagged as spam

Re: [mailop] Should mail servers publish IPv6 MX records? Could this harm your spam filtering?

2018-06-10 Thread John Levine
In article you write: >>> If a domain has no MX record, do all servers deliver to an record, >>> as required by (at least) RFC3974, > >You'd expect, No MX record, no mail delivery. MX is related to >hostname, not the transport stack. Only if you'd never read RFC 5321, particularly section 5

Re: [mailop] Sending mail to t-mobile.com

2018-06-10 Thread John Levine
In article <87sh5v7iut@mid.deneb.enyo.de> you write: >Is it expected that it is possible for the Internet at large to send >email to t-mobile.com addresses? > >It looks like they have some far-ranging network blocks for some >reason, at the TCP/IP level (connection attempts time out). Works fi

Re: [mailop] Is outlook.com blocking the Linode IP ranges?

2018-07-10 Thread John Levine
In article <3a2cef02-c892-0233-b2d8-c3c5ca3b7...@grinta.net> you write: >> outlook-com.olc.protection.outlook.com[104.47.8.33] said: 550 5.7.1 >> Unfortunately, messages from [109.74.203.128] weren't sent. I'm not very surprised. Linode does a poor job of keeping their customers from send

Re: [mailop] How to Update Email Address on File?

2018-07-17 Thread John Levine
>Dear MailOp Postmaster - what is the best way to update my email address on >file for this list? Click on the link at the bottom of every message. Scroll down that page to the Unsubscribe or Edit Options box near the bottom, click the button, Log in with your list password; if you don't know it

Re: [mailop] AWS bring your own IP

2018-07-19 Thread John Levine
In article you write: >-=-=-=-=-=- >-=-=-=-=-=- >Not sure of the detail of the implementation, but it's named "Bring Your Own >IP", not "Bring your ranges", so it could not fit with ESPs' needs. A few seconds looking at the AWS page reveals that you need to bring at least a /24 that is assign

Re: [mailop] DKIM headers - which do you sign and why?

2018-07-21 Thread John Levine
In article you write: >Here's the headers they're signing: h=to:cc:from:subject:reply-to:Date > >The forensic data samples I have show that a number of the messages that >fail seem to have injected different reply-to addresses, some of which >clearly belong to mailing lists. I suspect what's happ

Re: [mailop] DKIM headers - which do you sign and why?

2018-07-23 Thread John Levine
In article you write: >On Mon, 23 Jul 2018 at 20:16, Steve Atkins wrote: >> > On Jul 21, 2018, at 1:28 AM, Stefano Bagnara wrote: >> > [...] >> > Otherwise we keep weakening DMARC to a point where it is not useful >> > anymore. >> >> For many senders it's not useful; it's actively harmful. The

Re: [mailop] DKIM headers - which do you sign and why?

2018-07-24 Thread John Levine
tly. Give us a sample domain. I get yahoo reports every day, most recently this morning. -- Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. https://jl.ly

Re: [mailop] dmarc reports, was DKIM headers - which do you sign and why?

2018-07-24 Thread John Levine
In article you write: >I recieve dmarc aggregate reports from Yahoo to the ruf address in my >_dmarc record; gmail sends forensic/failure reports to the rua address. Any chance you got that backward? I get aggregate reports from both to the rua address and neither sends failure reports. I'd b

Re: [mailop] DKIM headers - which do you sign and why?

2018-07-24 Thread John Levine
In article you write: >"v=DMARC1; p=none; sp=none; rua=mailto:dmarc@mydomain!10m; >ruf=mailto:dmarc@mydomain!10m; rf=afrf; pct=100; ri=86400;" Ah, there's the problem. "mydomain" is an invalid mail domain. Pro tip: if you want real help, send real clues. It's not like your DMARC records are

Re: [mailop] Blacklisted by Gmail

2018-07-24 Thread John Levine
In article you write: >We already tried the official procedure and they told they took charge of >the request, but still no luck so far... So eventually my request for help >to the list. Wait a while and the blocks will age out. If you use a free service, sometimes you only get what you're payi

Re: [mailop] DKIM headers - which do you sign and why?

2018-07-25 Thread John Levine
In article you write: >And here the authorization record for the "cross-domain" report: > ># host -t txt emailmarketingblog.it._report._dmarc.mailvox.it >emailmarketingblog.it._report._dmarc.mailvox.it descriptive text "v=DMARC1" There's your problem. See the definition of dmarc-record in RFC 7

Re: [mailop] Is the 3rd-party reporting DMARC record required?

2018-08-16 Thread John Levine
data". Many of the failure reports I get are real mail that has been sent through a mailing list. It has the real name and address of the person who wrote the message. If that's not personal data, I don't know what is. R's, John -- Regards, John Levine, jo...@iecc.com, Pr

Re: [mailop] Is the 3rd-party reporting DMARC record required?

2018-08-16 Thread John Levine
In article you write: >> Many of the failure reports I get are real mail that has been sent >> through a mailing list. It has the real name and address of the >> person who wrote the message. If that's not personal data, I don't >> know what is. > >How is this related to "external destination v

Re: [mailop] Gmail - Anybody out there from Gmail, willing to assist with strange reputation issue

2018-08-28 Thread John Levine
In article <23nbod1hoj7v3puc1clpfrm4rtjuf6s...@honet.com> you write: >>I would also point out that seeing differences between mailbox providers in >>this instance is not really a surprise. You would be amazed, or maybe not, how many people with names similar to mine wrongly believe that my gmail a

Re: [mailop] How to find 'low flying' spamers? (Re: outlook.com blocking reason: S3150 "network is on our block list")

2018-10-01 Thread John Levine
In article <28c04515-a3e2-94bc-9ed2-6505ee089...@linuxmagic.com> you write: >With all respect, if someone advertises an SPF -all we SHOULD be >honouring this.. This was the senders wishes.. Like Brandon said, if it's a plain -all meaning no mail at all, sure. Otherwise, sorry pal, you don't get

Re: [mailop] Is SenderID deprecated? (Udeme Ukutt)

2018-10-05 Thread John Levine
S for Sender-ID records any more. R's, John -- Regards, John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. https://jl.ly ___ mailop mailing l

Re: [mailop] YahooMailProxy User Agent

2018-10-16 Thread John Levine
In article you write: >It is pretty common these days for spam systems to sometimes visit links in >the email message to help determine the spamminess or phishiness or just >plain badness of messages. It's one of the reasons for the newer >list-unsubscribe-post header in rfc 8058 (as mentioned i

Re: [mailop] YahooMailProxy User Agent

2018-10-16 Thread John Levine
In article you write: > >More than one redirector in a row is ... let's just say, Suspicious. Indeed, but you won't notice it unless you rattle the URLs. >Quite right. Malicious links often go through a long chain of redirects so >you have to follow the chain and see where it ends up. > >For

  1   2   3   4   5   6   7   8   9   >