Mailing List Archive: SPF: Help

"the traveling salesman" situation

Index | Next | Previous | View Threaded

junker at ericvey

Aug 11, 2005, 7:03 PM

Post #1 of 10 (1389 views)
Permalink

"the traveling salesman" situation

I've been very patient . . . waiting for someone more knowledgeable than
I, to say something about this. But no one has . . . so I will.

When I set up email for a company, I use ASMTP. This is now standard
(for at least 3 years) and it is also standard to maintain the server
software so that if a crack is found, the crack is sealed. If one wants
to have a mail server, then a minimum of effort is required to maintain it.

No mail server I have ever set up has cared where the IP was coming from
and with ASMTP, I really did not care. If they wanted to pay AOL, it was
none of my business provided they knew the proper username and password.

I realize that a few ISP's have limited SMTP to certain IP addresses,
but Earthlink (among them) abandoned that I idea if the customer went
through ASMTP.

I also realize that salesmen think they are above the rules. But once
their mail get bounced and a new Outlook Expresss account is set up for
them, the issue is over.

So, if the saleman has an account on the ASMTP server and his client
software knows about it, SPF shouldn't be an issue. The mail goes right
out as if the IP were local.

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

johnp at idimo

Aug 12, 2005, 1:08 AM

Post #2 of 10 (1381 views)
Permalink

Re: "the traveling salesman" situation [In reply to]

Eric Vey wrote:
> I've been very patient . . . waiting for someone more knowledgeable than
> I, to say something about this. But no one has . . . so I will.
>
> When I set up email for a company, I use ASMTP. This is now standard
> (for at least 3 years) and it is also standard to maintain the server
> software so that if a crack is found, the crack is sealed. If one wants
> to have a mail server, then a minimum of effort is required to maintain it.
>
> No mail server I have ever set up has cared where the IP was coming from
> and with ASMTP, I really did not care. If they wanted to pay AOL, it was
> none of my business provided they knew the proper username and password.
>
> I realize that a few ISP's have limited SMTP to certain IP addresses,
> but Earthlink (among them) abandoned that I idea if the customer went
> through ASMTP.
>
> I also realize that salesmen think they are above the rules. But once
> their mail get bounced and a new Outlook Expresss account is set up for
> them, the issue is over.
>
> So, if the saleman has an account on the ASMTP server and his client
> software knows about it, SPF shouldn't be an issue. The mail goes right
> out as if the IP were local.
>

They are providing a serice using smtp-auth , as do several other organisations. I am not
sure if they do have crossuser forgery protection, it's not mentioned in their website, so
users would still need to use ?all in their spf record, and not -all which is what I would
always prefer to use to make my policy tight.

Slainte,
JohnP

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

evey at ericvey

Aug 12, 2005, 5:36 AM

Post #3 of 10 (1371 views)
Permalink

Re: "the traveling salesman" situation [In reply to]

I'm sorry for the confusion. I did not realize that there was a company
with that name.
What I meant was "A"uthorized SMTP.

If a salesman authorizes through the company mail server and sends his
email out that way, there shouldn't be any trouble.

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

johnp at idimo

Aug 12, 2005, 5:51 AM

Post #4 of 10 (1341 views)
Permalink

Re: "the traveling salesman" situation [In reply to]

Eric Vey wrote:
> I'm sorry for the confusion. I did not realize that there was a company
> with that name.

Google is your friend ;-)

> What I meant was "A"uthorized SMTP.

Which is the standard means of overcoming this problem, but my comments about cross-user
forgery still stand.

>
> If a salesman authorizes through the company mail server and sends his
> email out that way, there shouldn't be any trouble.

Unless the ISP he is using blocks port 25, which quite a few of the big USA ones do - in
which case you must open port 24 or 587 and get the user to reconfigure his mail-client
with the appropriate port number. I am in the process of compiling the "idiots guide" to
configuring various mail-clients in this way and will post the url in due course.

Slainte,
JohnP

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

spf+help at de-korte

Aug 12, 2005, 6:02 AM

Post #5 of 10 (1361 views)
Permalink

Re: "the traveling salesman" situation [In reply to]

> They are providing a serice using smtp-auth , as do several other
> organisations. I am not
> sure if they do have crossuser forgery protection, it's not mentioned in
> their website, so
> users would still need to use ?all in their spf record, and not -all which
> is what I would
> always prefer to use to make my policy tight.

If there a no provisions to prevent cross-user forgery, you shouldn't use
a mechanism that grants a 'pass' for the shared mailservers, but instead
use 'neutral'. However, there is no reason not to publish a '-all' in that
case. I believe Scott sometimes uses a shared mailserver and still he can
end his SPF record with '-all'. Publishing '-all' is more about how
certain you are that other IP's that don't match the previous mechanisms
are allowed to send mail with a MAIL FROM from your domain.

Arjen

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

steve at teamITS

Aug 12, 2005, 7:40 AM

Post #6 of 10 (1363 views)
Permalink

Re: "the traveling salesman" situation [In reply to]

On Fri, 12 Aug 2005 10:08:58 +0200
johnp <johnp[at]idimo.com> wrote:

> I am not
> sure if they do have crossuser forgery protection, it's not mentioned in their website, so
> users would still need to use ?all in their spf record, and not -all

The syntax for this would be "... ?ip4:1.2.3.4 -all" which
grants a Neutral to the specified host yet Fail to all others.

- Steve Yates
- ITS, Inc.
- Do fish get cramps after eating?

~ Taglines by Taglinator 4 - www.srtware.com ~

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

spfhelp at emailspf

Aug 12, 2005, 9:46 AM

Post #7 of 10 (1383 views)
Permalink

Re: "the traveling salesman" situation [In reply to]

Eric Vey wrote:
> I'm sorry for the confusion. I did not realize that there was a company
> with that name.
> What I meant was "A"uthorized SMTP.
>
> If a salesman authorizes through the company mail server and sends his
> email out that way, there shouldn't be any trouble.
>
This is correct. It is the solution we use at work (with port 587 to
get past blocks and proxies). Works excellently, and since IT sets
up the laptops for sales there aren't configuration problems.

--
Daniel Taylor

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

nobody at xyzzy

Aug 12, 2005, 2:21 PM

Post #8 of 10 (1384 views)
Permalink

Re: "the traveling salesman" situation [In reply to]

Eric Vey wrote:

> I did not realize that there was a company with that name.

Nor me. The "official" (IANA registry) name is apparently
ESMTPA (ESMTP with AUTH) or ESMTPSA (Secure + Auth), see
http://www.iana.org/assignments/mail-parameters

> If a salesman authorizes through the company mail server
> and sends his email out that way, there shouldn't be any
> trouble.

Some potential trouble could be a blocked / redirected
port 25, in that case he needs a MUA supporting port 587
(submit, RfC 2476 and 2476bis).

RfC 2476 also offers protection against "cross user forgery"
by its optional "enforced submission rights" (in plain text
it checks that the authenticated user is also authorized to
use a certain MAIL FROM and not just anything).

So far all could be nice and work as designed. But NOT if
the receiver checks PRA (SenderID) agaist v=spf1, which is
explicitly NOT RECOMMENDED in the SPF spec.

For the latter the 2822-From (or the Sender) has to match
the MAIL FROM, and that's not guaranteed. Bye, Frank

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

tj.adams at itnweb

Aug 15, 2005, 6:01 AM

Post #9 of 10 (1385 views)
Permalink

RE: "the traveling salesman" situation [In reply to]

Yes this would be true but we still have the issue when ISP block
standard SMTP traffic on their networks. Many ISP are doing just that
so the only SMTP traffic flowing on their network is their SMTP traffic.
Here in Canada all the predominate players have executed such a policy.
This creates an issue for business clients that wish to have their own
mail server for tracking and storage of historical data.

We have been implementing such services for a few years and actually
help clients bring non-standard porting to the SMTP scene to allow the
hosts at our clients to process regular mail on SMTP 25 but allowing
clients to authenticate and submit mail on lets say port 26 to allow
mail to flow to clients using outlook and the like.

The world of email is becoming very tough waters to tread and I believe
that if SPF were truly implemented as intended then we would be
authenticating SMTP traffic using this protocol to verify the source.
As service providers we need to do something about the traffic on our
system when it comes to email and for now it seems that blocking port 25
to all outside sources on our networks is the only sure fire way to
ensure that only authenticated traffic flow on our networks.

My two cents.

Tj. Adams
ITN Inc.

99 Rocky Lake Drive, Bedford, Nova Scotia, B4A 2T3
Email: tj.adams[at]itnweb.com
Website: http://www.itnweb.com
Website: http://www.serviceplus.com

-----Original Message-----
From: Eric Vey [mailto:junker[at]ericvey.com]
Sent: August 11, 2005 11:03 PM
To: spf-help[at]v2.listbox.com
Subject: [spf-help] "the traveling salesman" situation

I've been very patient . . . waiting for someone more knowledgeable than
I, to say something about this. But no one has . . . so I will.

When I set up email for a company, I use ASMTP. This is now standard
(for at least 3 years) and it is also standard to maintain the server
software so that if a crack is found, the crack is sealed. If one wants
to have a mail server, then a minimum of effort is required to maintain
it.

No mail server I have ever set up has cared where the IP was coming from
and with ASMTP, I really did not care. If they wanted to pay AOL, it was
none of my business provided they knew the proper username and password.

I realize that a few ISP's have limited SMTP to certain IP addresses,
but Earthlink (among them) abandoned that I idea if the customer went
through ASMTP.

I also realize that salesmen think they are above the rules. But once
their mail get bounced and a new Outlook Expresss account is set up for
them, the issue is over.

So, if the saleman has an account on the ASMTP server and his client
software knows about it, SPF shouldn't be an issue. The mail goes right
out as if the IP were local.

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search) To
unsubscribe, change your address, or temporarily deactivate your
subscription, please go to
http://v2.listbox.com/member/?member_id=1368966&user_secret=ffa4848c

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

steve at teamITS

Aug 15, 2005, 7:48 AM

Post #10 of 10 (1373 views)
Permalink

Re: "the traveling salesman" situation [In reply to]

On Mon, 15 Aug 2005 10:01:57 -0300
<tj.adams[at]itnweb.com> wrote:

> Yes this would be true but we still have the issue when ISP block
> standard SMTP traffic on their networks. Many ISP are doing just that
> so the only SMTP traffic flowing on their network is their SMTP traffic.

Yes but I think with SPF and DomainKeys this practice will die
off eventually.

> We have been implementing such services for a few years and actually
> help clients bring non-standard porting to the SMTP scene to allow the
> hosts at our clients to process regular mail on SMTP 25 but allowing
> clients to authenticate and submit mail on lets say port 26 to allow

Port 587 is the correct port for SMTP authentication (aka
"submission"). Is that also being blocked?

- Steve Yates
- ITS, Inc.
- Look! It's a bird! It's a plane! It's FALLING!!!

~ Taglines by Taglinator 4 - www.srtware.com ~

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=8085f1ba

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com