Mailing List Archive: SPF: Deployment

spfmilter sometimes rejects sometimes accepts from same host

Index | Next | Previous | View Threaded

gdsm at tgfslp

Nov 27, 2005, 6:48 AM

Post #1 of 12 (14724 views)
Permalink

spfmilter sometimes rejects sometimes accepts from same host

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

My spfmilter is sometimes rejecting mail from a mailing list, but on other
occasions, is accepting mail from the same mailing list. Would anybody be
able to tell me why please? and how do I fix it?

550 5.7.1 <weather-bounces+user=tgfslp.dalmany.co.uk [at] buoy>...
rejected by spfmilter

log extract:
Nov 24 09:57:13 spitfire sm-mta[3580]: NOQUEUE: connect from mail [at] buoy
[216.204.160.109]
Nov 24 09:57:14 spitfire sm-mta[3580]: AUTH: available mech=DIGEST-MD5
CRAM-MD5, allowed mech=CRAM-MD5 DIGEST-MD5
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (dcc): init
success to negotiate
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (spfmilter):
init success to negotiate
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (clamav):
init success to negotiate
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: Milter: connect to
filters
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: milter=dcc,
action=connect, continue
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: milter=spfmilter,
action=connect, continue
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: milter=clamav,
action=connect, continue
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 220
mail.dalmany.co.uk ESMTP Sendmail 8.13.5/8.13.5/Debian-3; Thu, 24 Nov 2005
09:57:14 GMT; (No UCE/UBE) logging access from: buoy.com(OK)-mail [at] buoy
[216.204.160.109]
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: <-- EHLO
users.buoy.com
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: milter=spfmilter,
action=helo, continue
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: ---
250-mail.dalmany.co.uk Hello mail [at] buoy [216.204.160.109], pleased to
meet you
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: ---
250-ENHANCEDSTATUSCODES
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-PIPELINING
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-8BITMIME
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-SIZE
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-DSN
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-ETRN
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-AUTH
CRAM-MD5 DIGEST-MD5
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-STARTTLS
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-DELIVERBY
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250 HELP
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: <-- MAIL
FROM:<weather-bounces+gdsm=tgfslp.dalmany.co.uk [at] buoy> SIZE=5170
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: Milter: senders:
<weather-bounces+gdsm=tgfslp.dalmany.co.uk [at] buoy>
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: milter=dcc,
action=mail, continue
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: milter=spfmilter,
action=mail, reject=550 5.7.1 rejected by spfmilter
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (dcc): abort
filter
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: Milter:
from=<weather-bounces+gdsm=tgfslp.dalmany.co.uk [at] buoy>, reject=550
5.7.1 rejected by spfmilter
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: --- 550 5.7.1
<weather-bounces+gdsm=tgfslp.dalmany.co.uk [at] buoy>... rejected by
spfmilter
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: <-- RCPT
TO:<gdsm [at] tgfslp>
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: --- 503 5.0.0 Need
MAIL before RCPT
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: <-- DATA
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: --- 503 5.0.0 Need
MAIL command
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: <-- QUIT
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: --- 221 2.0.0
mail.dalmany.co.uk closing connection
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (dcc): quit
filter
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (spfmilter):
quit filter
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (clamav):
quit filter
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580:
from=<weather-bounces+gdsm=tgfslp.dalmany.co.uk [at] buoy>, size=5170,
class=0, nrcpts=0, proto=ESMTP, daemon=MTA-v4, relay=mail [at] buoy
[216.204.160.109]

I am using spfmilter 0.97, libspf 1.0, sendmail 8.13.5, linux 2.6.14. How
do I permit this to pass?

Many thanks,

Spencer

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDicciI1ja71kPXjARAjcgAKCGV7+7YOfWTDqI8XJebeQAZzN3YwCeNZ91
Qw73eDKQ5xkKQWtYlDmWsVw=
=SRLt
-----END PGP SIGNATURE-----

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

Matthew.van.Eerde at hbinc

Nov 28, 2005, 10:25 AM

Post #2 of 12 (14128 views)
Permalink

RE: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

G.D.S.Marshall wrote:
> My spfmilter is sometimes rejecting mail from a mailing list, but on
> other occasions, is accepting mail from the same mailing list. Would
> anybody be
> able to tell me why please? and how do I fix it?
>
> 550 5.7.1 <weather-bounces+user=tgfslp.dalmany.co.uk [at] buoy>...
> rejected by spfmilter

buoy.com has two SPF records:

v=spf1 ptr -all
v=spf1 mx -all

I would gather that one of these is correct, and one is wrong.

When spfmilter does the lookup, one of the SPF records is chosen at random.

When the correct one is chosen, the mail goes through.

When the wrong one is chosen, the mail is rejected.

spfmilter is CORRECT here. buoy.com is misconfigured.

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

mark at primefactor

Nov 28, 2005, 11:58 AM

Post #3 of 12 (14159 views)
Permalink

Re: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

On Mon, Nov 28, 2005 at 10:25:22AM -0800, Matthew.van.Eerde [at] hbinc wrote:
>
> buoy.com has two SPF records:
>
> v=spf1 ptr -all
> v=spf1 mx -all

Both of those records are pretty unusual:

$ host -t txt buoy.com
buoy.com text "\\\"v=spf1 mx -all\\\""
buoy.com text "\\\"v=spf1 ptr -all\\\""

Since neither record begins with "v=spf1 ", wouldn't that mean that
neither record qualifies as being an SPF record? (Meaning that the
expected result should be NONE.)

--
Mark Shewmaker
mark [at] primefactor

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

Matthew.van.Eerde at hbinc

Nov 28, 2005, 1:38 PM

Post #4 of 12 (14126 views)
Permalink

RE: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

Mark Shewmaker wrote:
> $ host -t txt buoy.com
> buoy.com text "\\\"v=spf1 mx -all\\\""
> buoy.com text "\\\"v=spf1 ptr -all\\\""

Huh?

$ host -t txt buoy.com
buoy.com text "v=spf1 mx -all"
buoy.com text "v=spf1 ptr -all"

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

robert.barclay at returnpath

Nov 28, 2005, 1:40 PM

Post #5 of 12 (14137 views)
Permalink

RE: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

This domain appears to have two nameservers that don't exactly match. In
my experience this seems to be the most common cause of inconsistent
results for a host.

; <<>> DiG 9.2.4 <<>> buoy.com txt @unslept.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15361
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;buoy.com. IN TXT

;; ANSWER SECTION:
buoy.com. 3600 IN TXT "\\\"v=spf1 ptr
-all\\\""
buoy.com. 3600 IN TXT "\\\"v=spf1 mx -all\\\""

; <<>> DiG 9.2.4 <<>> buoy.com txt @users.buoy.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28671
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;buoy.com. IN TXT

;; ANSWER SECTION:
buoy.com. 3600 IN TXT "v=spf1 mx -all"
buoy.com. 3600 IN TXT "v=spf1 ptr -all"

-----Original Message-----
From: Matthew.van.Eerde [at] hbinc [mailto:Matthew.van.Eerde [at] hbinc]
Sent: Monday, November 28, 2005 2:38 PM
To: spf-deployment [at] v2
Subject: RE: [spf-deployment] spfmilter sometimes rejects sometimes
accepts from same host

Mark Shewmaker wrote:
> $ host -t txt buoy.com
> buoy.com text "\\\"v=spf1 mx -all\\\""
> buoy.com text "\\\"v=spf1 ptr -all\\\""

Huh?

$ host -t txt buoy.com
buoy.com text "v=spf1 mx -all"
buoy.com text "v=spf1 ptr -all"

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname=spf-deployment [at] v2

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

Matthew.van.Eerde at hbinc

Nov 28, 2005, 2:01 PM

Post #6 of 12 (14150 views)
Permalink

RE: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

Robert Barclay wrote:
> This domain appears to have two nameservers that don't exactly match.
> In my experience this seems to be the most common cause of
> inconsistent results for a host.

Wow...

OK, so buoy.com has two domain name servers AND two TXT records.

It looks like the replication between them is broken... so one has two text records of

v=spf1 ...
v=spf1 ...

and the other has text records of
\"v=spf1 ...
\"v=spf1 ...

where both the backslash and the quote are literal.

The good news is that the mail server in question satisfies both the PTR and the MX requirements. So you should get either PASS or NONE, right? I still don't understand how FAIL could come up.

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

gdsm at tgfslp

Nov 28, 2005, 2:10 PM

Post #7 of 12 (14138 views)
Permalink

RE: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> G.D.S.Marshall wrote:
>> My spfmilter is sometimes rejecting mail from a mailing list, but on
>> other occasions, is accepting mail from the same mailing list. Would
>> anybody be
>> able to tell me why please? and how do I fix it?
>>
>> 550 5.7.1 <weather-bounces+user=tgfslp.dalmany.co.uk [at] buoy>...
>> rejected by spfmilter
>
> buoy.com has two SPF records:
>
> v=spf1 ptr -all
> v=spf1 mx -all
>
> I would gather that one of these is correct, and one is wrong.
>
> When spfmilter does the lookup, one of the SPF records is chosen at
> random.
>
> When the correct one is chosen, the mail goes through.
>
> When the wrong one is chosen, the mail is rejected.
>
> spfmilter is CORRECT here. buoy.com is misconfigured.

Understood, I would have expected it to be on one line! I tried to get
spfmilter to log, however, --debug=99 and --nodaemon do not seem to add
much if anything to the logging. How do I get spfmilter to debug logs,
even if I use --debug=1, it does not work.

Many thanks,

Spencer

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD4DBQFDi4BTI1ja71kPXjARAvE+AJicaDlMupH6EivbH4Zs7NMEREXZAJ9YHlmc
ZkFVmfMysJl5h5VbpYv92A==
=0lVf
-----END PGP SIGNATURE-----

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

Matthew.van.Eerde at hbinc

Nov 28, 2005, 2:21 PM

Post #8 of 12 (14135 views)
Permalink

RE: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

Matthew.van.Eerde wrote:
> The good news is that the mail server in question satisfies both the
> PTR and the MX requirements. So you should get either PASS or NONE,
> right? I still don't understand how FAIL could come up.

Unless it's because of libspf not implementing the MX check. That would reduce one of the records to -all.

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

mark at primefactor

Nov 28, 2005, 2:46 PM

Post #9 of 12 (14145 views)
Permalink

Re: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

On Mon, Nov 28, 2005 at 02:01:48PM -0800, Matthew.van.Eerde [at] hbinc wrote:

[.good summary of two sets of two records from two nameservers deleted]

> The good news is that the mail server in question satisfies both the
> PTR and the MX requirements. So you should get either PASS or NONE,
> right? I still don't understand how FAIL could come up.

This is a bit convoluted, but:

1. If the spf query were returning just one record instead of two,
(or if spfmilter were ignoring one of the two records),

AND

2. if that one record used/seen as starting with the right token,
that is with no quotes or backslashes, (or if spfmilter were
ignoring those beginning backslashes and quotes),

AND

3. if spfmmilter *didn't* ignore the quote and backslash in the trailing
-all\"

Then maybe spfmilter could be rejecting on a PERMERROR, since:

-all

would be a recognized mechanism, but

-all\"

is an unrecognized mechanism.

Could something like that be going on? (Or rather, is there a path
through that convoluted mess that might correspond in some way with
reality?)

--
Mark Shewmaker
mark [at] primefactor

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

lennon at orcon

Nov 28, 2005, 3:37 PM

Post #10 of 12 (14145 views)
Permalink

Re: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

> The good news is that the mail server in question satisfies both the PTR
> and the MX requirements. So you should get either > PASS or NONE, right?
> I still don't understand how FAIL could come up.

bouy.com SHOULD give NONE as the SPF record starts with \\\ and it is not a
valid SPF record

Thanks
Craig

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

Matthew.van.Eerde at hbinc

Nov 28, 2005, 4:37 PM

Post #11 of 12 (14134 views)
Permalink

RE: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

Craig Whitmore wrote:
>> The good news is that the mail server in question satisfies both the
>> PTR and the MX requirements. So you should get either > PASS or
>> NONE, right? I still don't understand how FAIL could come up.
>
> bouy.com SHOULD give NONE as the SPF record starts with \\\ and it is
> not a valid SPF record

Well, it does, and it doesn't...

Two name servers:
$ host -t ns buoy.com
buoy.com name server buoy.com.
buoy.com name server unslept.com.

The first name server has two SPF records which are both fine:
$ host -t txt buoy.com buoy.com
Using domain server:
Name: buoy.com
Address: 216.204.160.109#53
Aliases:

buoy.com text "v=spf1 mx -all"
buoy.com text "v=spf1 ptr -all"

This should PASS.

The second name server has two malformed records:
$ host -t txt buoy.com unslept.com
Using domain server:
Name: unslept.com
Address: 168.100.186.146#53
Aliases:

buoy.com text "\\\"v=spf1 ptr -all\\\""
buoy.com text "\\\"v=spf1 mx -all\\\""

This should NONE.

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

spf2 at kitterman

Nov 28, 2005, 4:48 PM

Post #12 of 12 (14143 views)
Permalink

Re: spfmilter sometimes rejects sometimes accepts from same host [In reply to]

I'd like to suggest that this thread is better suited to spf-discuss or
spf-help and perhaps it ought to be followed up one of those places....

Scott K

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment [at] v2

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads