Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Qmail: users

SPF and Mailforwarding

 

 

Qmail users RSS feed   Index | Next | Previous | View Threaded


mail at oliwel

Apr 20, 2008, 11:49 PM

Post #1 of 3 (517 views)
Permalink
SPF and Mailforwarding

Hi List,

today, I was confronted with a critical problem :(

My qmail server hosts the domains xyz.com, the address info[at]xyz.com is
forwarded to a domain at another provider.
A mail with a senders address of the GMX Mailservice hit this alias, and
was forwarded to the other provider. The mail was rejected by them,
because the gmx.net domain uses SPF and I am obviously not an allowed
origin for it.

I know that this is a protocol immanent problem which was often
discussed, but I now urgently need some sort of workaround (Sender
rewriting?).

I run netqmail with vpopmail, if this matters.

regards

Oliver

--
Protect your environment - close windows and adopt a penguin!
PGP-Key: 3B2C 8095 A7DF 8BB5 2CFF 8168 CAB7 B0DD 3985 1721
Attachments: signature.asc (0.25 KB)


kyle-qmail at memoryhole

Apr 21, 2008, 8:37 AM

Post #2 of 3 (475 views)
Permalink
Re: SPF and Mailforwarding [In reply to]

On Monday, April 21 at 08:49 AM, quoth Oliver Welter:
> My qmail server hosts the domains xyz.com, the address info[at]xyz.com
> is forwarded to a domain at another provider.
> A mail with a senders address of the GMX Mailservice hit this alias, and
> was forwarded to the other provider. The mail was rejected by them,
> because the gmx.net domain uses SPF and I am obviously not an allowed
> origin for it.

The GMX Mailservice has decided to attempt to prevent you from
forwarding their email, and you are asking for some ideas for
circumventing their policy?

Ummm, okay. As long as you're aware of what you're doing.

Why is thwarting GMX so urgent?

> I know that this is a protocol immanent problem which was often
> discussed, but I now urgently need some sort of workaround (Sender
> rewriting?).

The easiest technique is to simply RESEND the message, with your own
server as the sender. To do so, you would simply put this in your
.qmail file:

|env NEWSENDER=postmaster[at]xyz.com forward $RECIPIENT

When you do so, you are taking responsibility for handling all bounces
(i.e. if $RECIPIENT doesn't exist) and you're claiming responsibility
for any and all spam that goes through that forward. This is
essentially equivalent to SPF sender rewriting, with the exception
that the "real" sender isn't being encoded in the sender address.

If you wish to encode the "real" sender in the new sender's address,
you can try something like this:

|env NEWSENDER=info-`echo $SENDER|sed 's/@/=/g'`@xyz.com forward $RECIPIENT

Now, this solution is *VERY* naive, and is generally a bad solution
for many reasons. Then again, so is SPF sender rewriting (SRS). Before
you go very far down this path, there are two web pages you need to
read and fully consider:

http://homepages.tesco.net/J.deBoynePollard/FGA/smtp-spf-is-harmful.html
http://ghewgill.livejournal.com/83857.html

~Kyle
--
The search for the truth is the noblest occupation of man. Its
publication is a duty.
-- Anne Louise Germaine de Stael


jeff at m2

Apr 23, 2008, 2:23 PM

Post #3 of 3 (438 views)
Permalink
Re: SPF and Mailforwarding [In reply to]

See also http://www.openspf.org/FAQ/Forwarding.

I got bit by this today as well. Since I'm receiving the forwarded mail
rather than doing the forwarding, I'll have to whitelist the (known)
forwarding system before I turn SPFBEHAVIOR back up to 3.

Oliver Welter wrote:
> Hi List,
>
> today, I was confronted with a critical problem :(
>
> My qmail server hosts the domains xyz.com, the address info[at]xyz.com is
> forwarded to a domain at another provider.
> A mail with a senders address of the GMX Mailservice hit this alias,
> and was forwarded to the other provider. The mail was rejected by
> them, because the gmx.net domain uses SPF and I am obviously not an
> allowed origin for it.
>
> I know that this is a protocol immanent problem which was often
> discussed, but I now urgently need some sort of workaround (Sender
> rewriting?).
>
> I run netqmail with vpopmail, if this matters.
>
> regards
>
> Oliver
>

Qmail users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact lists@gossamer-threads.com
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.