Mailing List Archive: SPF: Devel

Local policy - questionable ~all

Index | Next | Previous | View Threaded

troy at visiblepulse

Sep 13, 2007, 11:40 AM

Post #1 of 2 (1498 views)
Permalink

Local policy - questionable ~all

I also see a lot of SoftFail spam coming in.

example:
HELO = host130-97-dynamic.11-87-r.retail.telecomitalia.it
MAILFROM = cservice.refAQ61195523.gps [at] citizensbank

v=spf1 ip4:12.154.167.142 ip4:12.46.106.21 mx ~all

This message was a phishing spam. I believe that during the SPF transition the spammers take advantage of transitioning domains and try to push spam through using the SoftFail result. Too many domains are in transition right now - it's a free-for-all.

HELO = ppp-124.121.108.131.revip2.asianet.co.th, MAILFROM = jrafert471 [at] hersheys

HELO = ppp91-122-1-178.pppoe.avangard-dsl.ru, MAILFROM = itunes [at] new-music

HELO = mail.landschapsbeheerutrecht.nl, MAILFROM = do-not-reply [at] bankofamerica

My users have the option setting in their webmail control panel to treat "In-Transition Spam checks (~all) as Allowed or as Spam. They can whitelist the From address if they like overriding the SPF result.

--troy

---------- Original Message ----------------------------------
From: Jeremy Jackson <jerj [at] coplanar>
Reply-To: spf-devel [at] v2
Date: Thu, 13 Sep 2007 09:48:10 -0400

>Since implementing milter-greylist here a few weeks ago, the few spams
>that have reached my Inbox here have been from domains (presumably owned
>by or targeted by spammers) with SPF records ending in "+all"
>
>I see there is some ability to add local policy, but it seems like it
>would need to be extended to be a general purpose filter that could be
>used to remove the "+all" when being used by milter-greylist for
>auto-whitelisting, for example.
>
>--
>Jeremy Jackson
>Coplanar Networks
>(519)489-4903
>
>-------------------------------------------
>-----------------------------------------------------------------------
>To unsubscribe, change your address, or temporarily deactivate your
>subscription,
>please go to http://v2.listbox.com/member/?&
>Powered by Listbox: http://www.listbox.com
>

-------------------------------------------
-----------------------------------------------------------------------
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?member_id=1311533&id_secret=41679417-c22ddb
Powered by Listbox: http://www.listbox.com

stuart at bmsi

Sep 14, 2007, 9:56 AM

Post #2 of 2 (1394 views)
Permalink

Re: Local policy - questionable ~all [In reply to]

On Thu, 13 Sep 2007, Troy Fuqua wrote:

> My users have the option setting in their webmail control panel to treat
> "In-Transition Spam checks (~all) as Allowed or as Spam. They can whitelist
> the From address if they like overriding the SPF result.

I suggest tracking the reputation of both bankofamerica.com:softfail AND
bankofamerica.com:pass (plus any other SPF results). While having a
black and white manual override is essential, it is way too much trouble
for users to decide such policy on every domain. Hopefully your
override can be "per domain".

It is a bad idea to treat softfail identically for every domain. Every domain
publisher has a different idea of what it means. We can argue all we want
about which meaning is correct, but it isn't going to change what is published.
So go with the flow and use what the publisher is trying to tell you.
By tracking the reputation of each SPF result separately, the machine
gets a statistical idea of the meaning - good enough to start rejecting
bankofamerica.com:softfail after so many spams with no hams, or for that
matter, bargains.com:pass after so many spams with no hams.

--
Stuart D. Gathman <stuart [at] bmsi>
Business Management Systems Inc. Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flammis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.

-------------------------------------------
-----------------------------------------------------------------------
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?member_id=1311533&id_secret=42089184-6ffcea
Powered by Listbox: http://www.listbox.com

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads