Out of Office (was: SPF technical problems (was Re: email address forgery))

2010-11-29 Thread Neil Lazarow
I will be out of the office from 11/22/2010 through the Thanksgiving Day weekend, and returning on 11/29/2010. If the matter is urgent, please contact one of the following people: Timi Finley (tfin...@naknan.com) Romani Perera (rper...@naknan.com) Doug Finley (dfin...@naknan.com) Thanks,

Re: SPF technical problems (was Re: email address forgery)

2010-11-21 Thread Byung-Hee HWANG
Michael Scheidell michael.scheid...@secnap.com writes: On 11/15/10 11:43 AM, David F. Skoll wrote: As it stands now, the SPF spec permits so much waffling that it might as well not be used. Regards, then don't use it: I don't use SPF, thanks! -- 소여물 황병희(黃炳熙) | .. 출항 15분전.. Johnny, not

Re: SPF technical problems (was Re: email address forgery)

2010-11-20 Thread Marc Perkel
On 11/18/2010 9:55 AM, RW wrote: On Thu, 18 Nov 2010 16:00:48 +0100 Benny Pedersenm...@junc.org wrote: On tor 18 nov 2010 12:59:38 CET, Matus UHLAR - fantomas wrote On 16.11.10 07:48, Marc Perkel wrote: Spammer can and do use SPF so it's not a good white list either. If SPF is correct and

Re: SPF technical problems (was Re: email address forgery)

2010-11-20 Thread RW
On Sat, 20 Nov 2010 15:02:58 -0800 Marc Perkel supp...@junkemailfilter.com wrote: On 11/18/2010 9:55 AM, RW wrote: On Thu, 18 Nov 2010 16:00:48 +0100 Benny Pedersenm...@junc.org wrote: On tor 18 nov 2010 12:59:38 CET, Matus UHLAR - fantomas wrote On 16.11.10 07:48, Marc Perkel

Re: SPF technical problems (was Re: email address forgery)

2010-11-20 Thread Benny Pedersen
On søn 21 nov 2010 00:02:58 CET, Marc Perkel wrote Spammers can and do set SPF records too. spammers dont control YOUR whitelist, hard to understand :( 555 errors giving up -- xpoint http://www.unicom.com/pw/reply-to-harmful.html

Re: SPF technical problems (was Re: email address forgery)

2010-11-18 Thread Matus UHLAR - fantomas
On 16.11.10 07:48, Marc Perkel wrote: [...] Spammer can and do use SPF so it's not a good white list either. [...] If SPF is correct and the domain is in my white list then I'll pass it as white. [...] we call this shitting into one's own mouth. -- Matus UHLAR - fantomas, uh...@fantomas.sk

Re: SPF technical problems (was Re: email address forgery)

2010-11-18 Thread Benny Pedersen
On tor 18 nov 2010 12:59:38 CET, Matus UHLAR - fantomas wrote On 16.11.10 07:48, Marc Perkel wrote: Spammer can and do use SPF so it's not a good white list either. If SPF is correct and the domain is in my white list then I'll pass it as white. we call this shitting into one's own mouth.

Re: SPF technical problems (was Re: email address forgery)

2010-11-18 Thread RW
On Thu, 18 Nov 2010 16:00:48 +0100 Benny Pedersen m...@junc.org wrote: On tor 18 nov 2010 12:59:38 CET, Matus UHLAR - fantomas wrote On 16.11.10 07:48, Marc Perkel wrote: Spammer can and do use SPF so it's not a good white list either. If SPF is correct and the domain is in my white list

Re: SPF technical problems (was Re: email address forgery)

2010-11-16 Thread Marc Perkel
On 11/15/2010 10:25 AM, David F. Skoll wrote: On Mon, 15 Nov 2010 08:07:43 -1000 Alexandre Chapellonalexandre.chapel...@mana.pf wrote: I use it just the same for the domains I have complete controm over. Unfortunately, be aware that this setup maybe forbid your legitimate emails to be

Re: SPF technical problems (was Re: email address forgery)

2010-11-16 Thread John Hardin
On Tue, 16 Nov 2010, Marc Perkel wrote: Spammer can and do use SPF so it's not a good white list either. That was never its intent. If SPF is correct and the domain is in my white list then I'll pass it as white. _that_ is its intent. -- John Hardin KA7OHZ

Re: SPF technical problems (was Re: email address forgery)

2010-11-16 Thread Alexandre Chapellon
Le mardi 16 novembre 2010 à 07:48 -0800, Marc Perkel a écrit : On 11/15/2010 10:25 AM, David F. Skoll wrote: On Mon, 15 Nov 2010 08:07:43 -1000 Alexandre Chapellonalexandre.chapel...@mana.pf wrote: I use it just the same for the domains I have complete controm over. Unfortunately,

Re: SPF technical problems (was Re: email address forgery)

2010-11-16 Thread Benny Pedersen
On tir 16 nov 2010 16:48:28 CET, Marc Perkel wrote Other than that - it just plain doesn't work. spammers can do what thay like, but add sender domain to spf whitelist here is not there bussiness do you belive its spammers rule the world ? example of a invalid spf

Re: email address forgery

2010-11-15 Thread Daniel McDonald
On 11/14/10 9:41 AM, Marc Perkel supp...@junkemailfilter.com wrote: On 11/11/2010 5:07 PM, Rob McEwen wrote: On 11/11/2010 7:41 PM, Noel Butler wrote: Really? I don't use SPF in SA, only MTA, if that's the case, it is a shame that SA also is behind the times. It was years ago SPF type

Re: email address forgery

2010-11-15 Thread Rob McEwen
On 11/15/2010 10:22 AM, Daniel McDonald wrote: I send from my phone just fine - Auth on the submission port to my home servers, then SPF matches the policy just fine. Dan, You've made many good points. Not trying to take away from those. However, in spite of what you said about forwarding

Re: email address forgery

2010-11-15 Thread Michael Scheidell
On 11/15/10 10:48 AM, Rob McEwen wrote: ...I'm sure there are others I haven't thought about! All addressed by the standards. Yes, we advise our clients that SPF PUBLISHING and CHECKING are two different things, and for two different reasons. We tell them that if they use the '-all' tag,

SPF technical problems (was Re: email address forgery)

2010-11-15 Thread David F. Skoll
On Mon, 15 Nov 2010 11:30:59 -0500 Michael Scheidell michael.scheid...@secnap.com wrote: So, SPF works, if EVERYONE FOLLOWS THE RFC'S AND BEST PRACTICES. Not really. SPF is too weasely. If the SPF authors really wanted a useful standard, then: 1) The only return codes would have been pass,

Re: SPF technical problems (was Re: email address forgery)

2010-11-15 Thread Michael Scheidell
On 11/15/10 11:43 AM, David F. Skoll wrote: As it stands now, the SPF spec permits so much waffling that it might as well not be used. Regards, then don't use it: host -t txt roaringpenguin.com roaringpenguin.com descriptive text v=spf1 a a:colo3.roaringpenguin.com

Re: SPF technical problems (was Re: email address forgery)

2010-11-15 Thread David F. Skoll
On Mon, 15 Nov 2010 11:50:50 -0500 Michael Scheidell michael.scheid...@secnap.com wrote: then don't use it: Our record follows the way I said SPF should work. It specifies only 4 hosts as authorized to send for us and has a hard -all at the end. That's because we took the time and trouble to

Re: email address forgery

2010-11-15 Thread John Hardin
On Mon, 15 Nov 2010, Rob McEwen wrote: But the user often wants to set a from address as being their regular business e-mail address so that they then get replies to blackberry-sent messages to BOTH their desktop computers and their blackberry. (otherwise, they'd only get the reply on their

Re: SPF technical problems (was Re: email address forgery)

2010-11-15 Thread Alexandre Chapellon
I use it just the same for the domains I have complete controm over. Unfortunately, be aware that this setup maybe forbid your legitimate emails to be forwarded by a foreign host: let's say your authorized server sends email in your name to a remote mailbox (let's say Yahoo!), which is setup to

Re: SPF technical problems (was Re: email address forgery)

2010-11-15 Thread David F. Skoll
On Mon, 15 Nov 2010 08:07:43 -1000 Alexandre Chapellon alexandre.chapel...@mana.pf wrote: I use it just the same for the domains I have complete controm over. Unfortunately, be aware that this setup maybe forbid your legitimate emails to be forwarded by a foreign host: Yes, this is a

Re: email address forgery

2010-11-14 Thread Marc Perkel
On 11/11/2010 5:07 PM, Rob McEwen wrote: On 11/11/2010 7:41 PM, Noel Butler wrote: Really? I don't use SPF in SA, only MTA, if that's the case, it is a shame that SA also is behind the times. It was years ago SPF type was ratified. Justin: Any plans to change that? I guess I'm one of those

Re: email address forgery

2010-11-14 Thread Marc Perkel
On 11/11/2010 5:07 PM, Rob McEwen wrote: On 11/11/2010 7:41 PM, Noel Butler wrote: Really? I don't use SPF in SA, only MTA, if that's the case, it is a shame that SA also is behind the times. It was years ago SPF type was ratified. Justin: Any plans to change that? I guess I'm one of those

Re: email address forgery

2010-11-12 Thread Martin Gregorie
On Fri, 2010-11-12 at 08:50 +0200, Jeremy Van Rooyen wrote: This snippet is what I get in my email log(quit allot of them everyday). On the user side I get the following (bounce back email): Delivery Status Notification (Failure) or Message Undeliverable! with the original email attached

RE: email address forgery

2010-11-12 Thread Rosenbaum, Larry M.
: email address forgery On Thu, 2010-11-11 at 10:07 -0500, Rob McEwen wrote: On 11/11/2010 9:11 AM, Jeremy Van Rooyen wrote: Can anybody explain to me how to do this and how would I be able to test it? Jeremy, I really like to use the following wizard to generate my SPF strings: http

Re: email address forgery

2010-11-12 Thread Matus UHLAR - fantomas
On 12.11.10 11:33, Rosenbaum, Larry M. wrote: Are there domains that have actually defined SPF record type records? I haven’t been able to find any, but it could be the fault of the tools I’m using. the few domains in our employers' system(s) do have them set. ... and my domain too. --

Re: email address forgery

2010-11-12 Thread Karsten Bräckelmann
On Fri, 2010-11-12 at 08:50 +0200, Jeremy Van Rooyen wrote: Delivery Status Notification (Failure) or Message Undeliverable! with the original email attached which is spam. Backscatter. Other than the SPF record, the SA VBounce plugin might also help you to filter out the backscatter on your

Re: email address forgery

2010-11-12 Thread René Berber
On 11/11/2010 10:54 PM, Noel Butler wrote: http://tools.ietf.org/html/rfc4408 Thanks, the definition is what I guessed from Jason's response, and tested on my DNS servers. You should have also pointed out section 3.1.1 : An SPF-compliant domain name SHOULD have SPF records of both RR

Re: email address forgery

2010-11-12 Thread Ken A
On 11/11/2010 7:07 PM, Rob McEwen wrote: On 11/11/2010 7:41 PM, Noel Butler wrote: Really? I don't use SPF in SA, only MTA, if that's the case, it is a shame that SA also is behind the times. It was years ago SPF type was ratified. Justin: Any plans to change that? I guess I'm one of those

Re: email address forgery

2010-11-12 Thread Benny Pedersen
On fre 12 nov 2010 23:43:06 CET, Ken A wrote I find it useful for whitelisting (whitelist_auth) things like banks, or other trusted, and properly configured SPF senders. But, as a small ISP with lots of roaming users, SPF is pretty much useless for outgoing mail (?all). +all is also

Re: email address forgery

2010-11-12 Thread Jason Bertoch
On 11/12/2010 11:33 AM, Rosenbaum, Larry M. wrote: Are there domains that have actually defined SPF record type records? I haven’t been able to find any, but it could be the fault of the tools I’m using. I set both for customers that request SPF records of any type and for those without an

Re: email address forgery

2010-11-12 Thread Jason Bertoch
On 11/11/2010 9:45 PM, David F. Skoll wrote: On Thu, 11 Nov 2010 21:35:11 -0500 Jason Bertochja...@i6ix.com wrote: After many complaints from the DNS community over SPF hijacking the TXT record, a new SPF record type was eventually accepted. The proper fix would have been to make SPF lookups

Re: email address forgery

2010-11-11 Thread Rob McEwen
On 11/11/2010 9:11 AM, Jeremy Van Rooyen wrote: Can anybody explain to me how to do this and how would I be able to test it? Jeremy, I really like to use the following wizard to generate my SPF strings: http://www.openspf.org/ Scroll down to the section that says Deploying SPF, enter the

Re: email address forgery

2010-11-11 Thread Karsten Bräckelmann
On Thu, 2010-11-11 at 16:11 +0200, Jeremy Van Rooyen wrote: Thanks to this list who help me(Newby) with my Spamassasin configuration the last time, but here I am again. I've been having email spoofing issues for sometime now and have complaints about it allot. Please elaborate. What exactly

Re: email address forgery

2010-11-11 Thread Noel Butler
On Thu, 2010-11-11 at 10:07 -0500, Rob McEwen wrote: On 11/11/2010 9:11 AM, Jeremy Van Rooyen wrote: Can anybody explain to me how to do this and how would I be able to test it? Jeremy, I really like to use the following wizard to generate my SPF strings: http://www.openspf.org/

Re: email address forgery

2010-11-11 Thread Michael Scheidell
On 11/11/10 5:13 PM, Noel Butler wrote: *and* as an SPF record type, the TXT method is deprecated, but then again, SA doesn't support SPF record type, only TXT type.. -- Michael Scheidell, CTO o: 561-999-5000 d: 561-948-2259 ISN: 1259*1300 *| *SECNAP Network Security Corporation *

Re: email address forgery

2010-11-11 Thread Noel Butler
On Thu, 2010-11-11 at 17:31 -0500, Michael Scheidell wrote: On 11/11/10 5:13 PM, Noel Butler wrote: *and* as an SPF record type, the TXT method is deprecated, but then again, SA doesn't support SPF record type, only TXT type.. Really? I don't use SPF in SA, only MTA, if that's the

Re: email address forgery

2010-11-11 Thread Jason Bertoch
On 11/11/2010 7:41 PM, Noel Butler wrote: On Thu, 2010-11-11 at 17:31 -0500, Michael Scheidell wrote: On 11/11/10 5:13 PM, Noel Butler wrote: *and* as an SPF record type, the TXT method is deprecated, but then again, SA doesn't support SPF record type, only TXT type.. Really? I don't use

Re: email address forgery

2010-11-11 Thread Rob McEwen
On 11/11/2010 7:41 PM, Noel Butler wrote: Really? I don't use SPF in SA, only MTA, if that's the case, it is a shame that SA also is behind the times. It was years ago SPF type was ratified. Justin: Any plans to change that? I guess I'm one of those mail admins who is behind the times. But I

Re: email address forgery

2010-11-11 Thread Karsten Bräckelmann
On Thu, 2010-11-11 at 19:57 -0500, Jason Bertoch wrote: On 11/11/2010 7:41 PM, Noel Butler wrote: but then again, SA doesn't support SPF record type, only TXT type.. Really? I don't use SPF in SA, only MTA, if that's the case, it is a shame that SA also is behind the times. It was

Re: email address forgery

2010-11-11 Thread René Berber
On 11/11/2010 4:13 PM, Noel Butler wrote: *and* as an SPF record type, the TXT method is deprecated, but for time being it's good to use it since there are a lot, and I mean a LOT of outdated DNS servers around that do not support it even today, yes, the fault of the DNS server admin for

Re: email address forgery

2010-11-11 Thread Jason Bertoch
On 11/11/2010 8:09 PM, Karsten Bräckelmann wrote: On Thu, 2010-11-11 at 19:57 -0500, Jason Bertoch wrote: On 11/11/2010 7:41 PM, Noel Butler wrote: but then again, SA doesn't support SPF record type, only TXT type.. Really? I don't use SPF in SA, only MTA, if that's the case, it is a shame

Re: email address forgery

2010-11-11 Thread Jason Bertoch
On 11/11/2010 8:38 PM, René Berber wrote: On 11/11/2010 4:13 PM, Noel Butler wrote: *and* as an SPF record type, the TXT method is deprecated, but for time being it's good to use it since there are a lot, and I mean a LOT of outdated DNS servers around that do not support it even today,

Re: email address forgery

2010-11-11 Thread David F. Skoll
On Thu, 11 Nov 2010 21:35:11 -0500 Jason Bertoch ja...@i6ix.com wrote: After many complaints from the DNS community over SPF hijacking the TXT record, a new SPF record type was eventually accepted. The proper fix would have been to make SPF lookups for example.com request the TXT record for

Re: email address forgery

2010-11-11 Thread Karsten Bräckelmann
On Thu, 2010-11-11 at 21:19 -0500, Jason Bertoch wrote: On 11/11/2010 8:09 PM, Karsten Bräckelmann wrote: /me points at bugzilla Guys, mind checking there? If there's not even a bug filed about it, the answer most likely would be no plans yet. As an exercise to the reader, if there's

Re: email address forgery

2010-11-11 Thread Benny Pedersen
On tor 11 nov 2010 23:13:51 CET, Noel Butler wrote *and* as an SPF record type, the TXT method is deprecated, but for time being it's good to use it since there are a lot, and I mean a LOT of outdated DNS servers around that do not support it even today, yes, the fault of the DNS server admin

Re: email address forgery

2010-11-11 Thread Benny Pedersen
On tor 11 nov 2010 23:31:11 CET, Michael Scheidell wrote On 11/11/10 5:13 PM, Noel Butler wrote: *and* as an SPF record type, the TXT method is deprecated, but then again, SA doesn't support SPF record type, only TXT type.. uninstall Mail::SPF::Query install Mail::SPF problem solved have

Re: email address forgery

2010-11-11 Thread Noel Butler
On Thu, 2010-11-11 at 20:07 -0500, Rob McEwen wrote: On 11/11/2010 7:41 PM, Noel Butler wrote: Really? I don't use SPF in SA, only MTA, if that's the case, it is a shame that SA also is behind the times. It was years ago SPF type was ratified. Justin: Any plans to change that? I guess

Re: email address forgery

2010-11-11 Thread Noel Butler
On Thu, 2010-11-11 at 19:38 -0600, René Berber wrote: On 11/11/2010 4:13 PM, Noel Butler wrote: *and* as an SPF record type, the TXT method is deprecated, but for time being it's good to use it since there are a lot, and I mean a LOT of outdated DNS servers around that do not support

Re: email address forgery

2010-11-11 Thread Jeremy Van Rooyen
To give more detail on my issue is as follows: *example log: * 1PGasp-0007C4-Tl SA: Debug: SAEximRunCond expand returned: '1 ' 1PGasp-0007C4-Tl SA: Debug: check succeeded, running spamc 1PGasp-0007C4-Tl SA: Action: scanned but message isn't spam: score=-1.0 required=7.0 (scanned in 1/1 secs |