Mailing List Archive: SPF: Help

SPF syntax correct?

1 2

View All

Index | Next | Previous | View Threaded

eslbase at eslbase

Jan 8, 2007, 2:05 PM

Post #1 of 40 (6540 views)
Permalink

SPF syntax correct?

Hello

My host has set up the following SPF record for my domain:

"v=spf1 mx ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245 ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249 ip4:66.232.129.250 ~all."

Note the dot at the end. I have run this through an SPF validator and it tells me "~all." is unrecognised.

My domain is sending out a lot of spam/spoofed email that looks like it comes from my domain, but does not, and I've received complaints from people about spam from my domain. This would suggest to me that the SPF record is wrong.

But my host says the dot at the end is added automatically and they cannot remove it. Is this correct?

Many thanks

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

scott at kitterman

Jan 8, 2007, 2:12 PM

Post #2 of 40 (6475 views)
Permalink

Re: SPF syntax correct? [In reply to]

On Monday 08 January 2007 17:05, eslbase wrote:
> Hello
>
> My host has set up the following SPF record for my domain:
>
> "v=spf1 mx ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
> ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249
> ip4:66.232.129.250 ~all."
>
> Note the dot at the end. I have run this through an SPF validator and it
> tells me "~all." is unrecognised.
>
> My domain is sending out a lot of spam/spoofed email that looks like it
> comes from my domain, but does not, and I've received complaints from
> people about spam from my domain. This would suggest to me that the SPF
> record is wrong.
>
> But my host says the dot at the end is added automatically and they cannot
> remove it. Is this correct?
>
I don't know if they can remove it or not, but it's presence is incorrect.

You can test records at:

http://www.kitterman.com/spf/validate.html

If your provider is not capable of removing dots from TXT records, there are
others that can:

http://www.kitterman.com/spf/txt.html

Scott K

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

steve at teamITS

Jan 8, 2007, 2:21 PM

Post #3 of 40 (6482 views)
Permalink

RE: SPF syntax correct? [In reply to]

eslbase <mailto:eslbase[at]eslbase.com> wrote on Monday, January 08, 2007
4:05 PM:

> But my host says the dot at the end is added automatically and they
cannot
> remove it. Is this correct?

Dots are required for CNAME/MX records and other hostname
records. Otherwise for the domain example.com something like this:

example.com IN MX mail.example.net

...may (should?) get translated to mail.example.net.example.com by the
DNS server. By contrast:

example.com IN MX mail.example.net.

...means not to append the domain name. It is incorrect to add the dot
to TXT records.

If your record is invalid SPF isn't going to work for you.

-----
SPF FAQ: http://www.openspf.org/FAQ
Common mistakes: http://www.openspf.org/FAQ/Common_mistakes

- Steve Yates
- ITS, Inc.
- Cat toy (n): any object on the ground.

~ Taglines by Taglinator - www.srtware.com ~

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 8, 2007, 2:22 PM

Post #4 of 40 (6468 views)
Permalink

Re: SPF syntax correct? [In reply to]

Many thanks for the reply Scott

Here's what my host said:

"The dot "." is being added automatically it seems by the DNS system because
this is a TXT/SPF record and not an A DNS record. Unfortunately, we won't be
able to remove this from the DNS record"

I don't know the difference between a TXT/SPF record and an A DNS record,
but could it make a difference as to their ability to remove the dot?

Here is the SPF record they have set up for me:

"v=spf1 mx ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249
ip4:66.232.129.250 ~all."

Thanks again

Keith

----- Original Message -----
From: "Scott Kitterman" <scott[at]kitterman.com>
To: <spf-help[at]v2.listbox.com>
Sent: Monday, January 08, 2007 11:12 PM
Subject: Re: [spf-help] SPF syntax correct?

> On Monday 08 January 2007 17:05, eslbase wrote:
>> Hello
>>
>> My host has set up the following SPF record for my domain:
>>
>> "v=spf1 mx ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
>> ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248
>> ip4:66.232.129.249
>> ip4:66.232.129.250 ~all."
>>
>> Note the dot at the end. I have run this through an SPF validator and it
>> tells me "~all." is unrecognised.
>>
>> My domain is sending out a lot of spam/spoofed email that looks like it
>> comes from my domain, but does not, and I've received complaints from
>> people about spam from my domain. This would suggest to me that the SPF
>> record is wrong.
>>
>> But my host says the dot at the end is added automatically and they
>> cannot
>> remove it. Is this correct?
>>
> I don't know if they can remove it or not, but it's presence is incorrect.
>
> You can test records at:
>
> http://www.kitterman.com/spf/validate.html
>
> If your provider is not capable of removing dots from TXT records, there
> are
> others that can:
>
> http://www.kitterman.com/spf/txt.html
>
> Scott K
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/ or
> http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to
> http://v2.listbox.com/member/?&
>

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

steve at teamITS

Jan 8, 2007, 2:28 PM

Post #5 of 40 (6468 views)
Permalink

RE: SPF syntax correct? [In reply to]

Steve Yates <mailto:steve[at]teamITS.com> wrote on Monday, January 08, 2007
4:21 PM:

> Dots are required for CNAME/MX records and other hostname
> records.

Let me restate that. Dots are used to "finish off" the
hostname, when a full hostname is entered.

example.com IN MX mail

...means to assume the right side equals "mail.example.com". Having

example.com IN MX mail.example.net.

...means that you are specifically stating a complete hostname.

Keith, their comment that "The dot '.' is being added
automatically it seems by the DNS system because
this is a TXT/SPF record and not an A DNS record" is incorrect because A
records are not the only DNS records that don't use a dot.

"Unfortunately, we won't be able to remove this from the DNS
record" probably means they have a program that enters those DNS records
and that's how the program works, and this tech can't rewrite the
program.

-----
SPF FAQ: http://www.openspf.org/FAQ
Common mistakes: http://www.openspf.org/FAQ/Common_mistakes

- Steve Yates
- ITS, Inc.
- Beer is proof that God loves us and wants us to be happy. --Benjamin
Franklin

~ Taglines by Taglinator - www.srtware.com ~

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

scott at kitterman

Jan 8, 2007, 2:33 PM

Post #6 of 40 (6464 views)
Permalink

Re: SPF syntax correct? [In reply to]

On Monday 08 January 2007 17:28, Steve Yates wrote:
> Steve Yates <mailto:steve[at]teamITS.com> wrote on Monday, January 08, 2007
>
> 4:21 PM:
> > Dots are required for CNAME/MX records and other hostname
> > records.
>
> Let me restate that. Dots are used to "finish off" the
> hostname, when a full hostname is entered.
>
> example.com IN MX mail
>
> ...means to assume the right side equals "mail.example.com". Having
>
> example.com IN MX mail.example.net.
>
> ...means that you are specifically stating a complete hostname.
>
> Keith, their comment that "The dot '.' is being added
> automatically it seems by the DNS system because
> this is a TXT/SPF record and not an A DNS record" is incorrect because A
> records are not the only DNS records that don't use a dot.
>
> "Unfortunately, we won't be able to remove this from the DNS
> record" probably means they have a program that enters those DNS records
> and that's how the program works, and this tech can't rewrite the
> program.

Is www.hostway.co.uk your provider? Two options at this point:

1. Tech support guy you talked to doesn't know what he's talking about.

2. Provider is incompetent and you should get another one.

Bottom line is it's a braindead answer. Please verify who your provider is so
I can note their "special" approach on our list of DNS providers that do TXT.

Scott K

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

spf at beer

Jan 8, 2007, 2:36 PM

Post #7 of 40 (6468 views)
Permalink

Re: SPF syntax correct? [In reply to]

At the risk of being blunt...

> "The dot "." is being added automatically it seems by the DNS system
> because this is a TXT/SPF record and not an A DNS record.

Your providers don't appear to know what they're talking about.

Trailing dots are used to denote absolute, rather than relative hostnames.
They are pretty much essential in A records, CNAMEs, and the like. They
should never be "added automatically" to a TXT record, which *by
definition* is sensitive to such things. Truth to tell, they should never
be added automatically to anything...

> Unfortunately, we won't be
> able to remove this from the DNS record"

Then they are idiots.

Your record is entirely useless in the state it's in. If your provider
can't let you have the record without the trailing dot, then your provider
is entirely useless as well.

I suggest you find someone better to do your DNS. When I was faced with a
similar situation, I decided thast the best person to look after my
interests was myself[1]. You might like to take the same route...

> I don't know the difference between a TXT/SPF record and an A DNS record,
> but could it make a difference as to their ability to remove the dot?

Their ability to set records is purely down to their competence. Guess
what...

> Here is the SPF record they have set up for me:
>
> "v=spf1 mx ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
> ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249
> ip4:66.232.129.250 ~all."

This won't work. It can't work. It is invalid. And that is your provider's
fault.

Vic.

[1] It quickly occurred to me that, although I was a _total_ neophyte at
DNS at the time, I still knew *at least* as much as the purported
"experts" from my (then) ISP. So I binned their service and did it myself,
using BIND and Webmin. I haven't looked back...

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

alex at ergens

Jan 8, 2007, 2:53 PM

Post #8 of 40 (6470 views)
Permalink

Re: SPF syntax correct? [In reply to]

On Mon, Jan 08, 2007 at 11:05:17PM +0100, eslbase wrote:
> Hello
>
> My host has set up the following SPF record for my domain:

No, for just one of your domains. For instance, your domain
www.eslbase.com does exist but has no SPF record. Spammers
can still spoof mail as "bla[at]www.eslbase.com". And so on for
all of your other domains in DNS _zone_ eslbase.com.

> "v=spf1 mx ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245 ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249 ip4:66.232.129.250 ~all."

Notice how MX(eslbase.com) resolves to hostname mail.eslbase.com, and
how A(mail.eslbase.com) resolves to IP address 66.232.130.50

Suppose "mx" did not match, do you think ip4:66.232.130.50 will match? Why?

Suppose "mx" would match; wouldn't it be better to have a match on
"ip4:66.232.130.50" instead, which does not require additional DNS processing?
That's why "ip4" should go up front.

> Note the dot at the end. I have run this through an SPF validator and it tells me "~all." is unrecognised.

Indeed.

> But my host says the dot at the end is added automatically and they cannot remove it. Is this correct?

Either the support representative is faulty, or the ISP's software is. If
you want a text string published, there's no reason -at all- to append a
dot.

SPF has made a workaround available. Add the following to the record,
right after "-all" but separated by a space: "iArna.com=faulty"

The end of your record then looks like:

..."232.129.249 ip4:66.232.129.250 ~all iArna.com=faulty."

Don't expect people to reject forged email based on this record. You have
"<tilde>-all", instead of "<dash>-all".

HTH
Alex

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 9, 2007, 2:29 AM

Post #9 of 40 (6472 views)
Permalink

Re: SPF syntax correct? [In reply to]

Thanks everyone for your help with this.

Scott - yes, www.hostway.co.uk is my provider.

Alex - I have a couple of questions...

Are you saying that "mx" should go at the end, so that it's like this:

"v=spf1 ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249
ip4:66.232.129.250 mx ~all."

Also, If I change the end of my record to look like this:

..."232.129.249 ip4:66.232.129.250 ~all iArna.com=faulty." using the
workaround you suggested, will it be valid and therefore solve the problem
of the dot at the end?

And finally, do you recommend using "<dash>-all" instead of."<tilde>~all"
to stop the spoofing?

I have emailed my provider again - I guess I'll give them one more chance to
sort it out and then think about changing providers...

Many thanks once again for this invaluable advice.

Keith

----- Original Message -----
From: "Alex van den Bogaerdt" <alex[at]ergens.op.het.net>
To: <spf-help[at]v2.listbox.com>
Sent: Monday, January 08, 2007 11:53 PM
Subject: Re: [spf-help] SPF syntax correct?

> On Mon, Jan 08, 2007 at 11:05:17PM +0100, eslbase wrote:
>> Hello
>>
>> My host has set up the following SPF record for my domain:
>
>
> No, for just one of your domains. For instance, your domain
> www.eslbase.com does exist but has no SPF record. Spammers
> can still spoof mail as "bla[at]www.eslbase.com". And so on for
> all of your other domains in DNS _zone_ eslbase.com.
>
>
>> "v=spf1 mx ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
>> ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248
>> ip4:66.232.129.249 ip4:66.232.129.250 ~all."
>
>
> Notice how MX(eslbase.com) resolves to hostname mail.eslbase.com, and
> how A(mail.eslbase.com) resolves to IP address 66.232.130.50
>
> Suppose "mx" did not match, do you think ip4:66.232.130.50 will match?
> Why?
>
> Suppose "mx" would match; wouldn't it be better to have a match on
> "ip4:66.232.130.50" instead, which does not require additional DNS
> processing?
> That's why "ip4" should go up front.
>
>> Note the dot at the end. I have run this through an SPF validator and it
>> tells me "~all." is unrecognised.
>
> Indeed.
>
>> But my host says the dot at the end is added automatically and they
>> cannot remove it. Is this correct?
>
> Either the support representative is faulty, or the ISP's software is. If
> you want a text string published, there's no reason -at all- to append a
> dot.
>
> SPF has made a workaround available. Add the following to the record,
> right after "-all" but separated by a space: "iArna.com=faulty"
>
> The end of your record then looks like:
>
> ..."232.129.249 ip4:66.232.129.250 ~all iArna.com=faulty."
>
>
> Don't expect people to reject forged email based on this record. You have
> "<tilde>-all", instead of "<dash>-all".
>
> HTH
> Alex
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/ or
> http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to
> http://v2.listbox.com/member/?&
>

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

alex at ergens

Jan 9, 2007, 2:53 AM

Post #10 of 40 (6464 views)
Permalink

Re: SPF syntax correct? [In reply to]

On Tue, Jan 09, 2007 at 11:29:46AM +0100, eslbase wrote:

> Are you saying that "mx" should go at the end, so that it's like this:
>
> "v=spf1 ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
> ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249
> ip4:66.232.129.250 mx ~all."

No. Basically what I'm saying is that (in your case) mx is equivalent
to ip4:66.232.130.50 and should be left out.

You are asking us to do this for every incoming connection:

a: "mx":
a1) DNS lookup the MX record for your domain
a2) Parse the answer, subtract the host part from it
a3) DNS lookup the A record for the hostname from (2)
a4) Compare against the resulting IP address: 66.232.130.50
continue if no match was found

b: "ip4:66.232.130.50"
b1) Compare against the specified IP address: 66.232.130.50
continue if no match was found

See how step a4 and b1 do the same thing? If one matches, so would
the other, if one does not match, neither will the other. So, why do
step "a" at all ? Step b is much faster *and* cheaper.

I also made a remark how "ip4" should go up front, in general, to
avoid unnecessary lookups. In my example, this would mean doing
'series' b first, then series a. This saves a couple of DNS lookups
in case the "ip4" mechanism matches.

If you want to keep "mx" (for whatever reason) at least move it to the
back. Please be aware that everything in front of it would not match
in case of a forgery, and thus everyone receiving such a forgery would
be required to lookup your MX host. In other words, you would ask those
nice people that avoid generating bounces for you, to do additional (and
more important: useless!) processing.

> Also, If I change the end of my record to look like this:
>
> ..."232.129.249 ip4:66.232.129.250 ~all iArna.com=faulty." using the
> workaround you suggested, will it be valid and therefore solve the problem
> of the dot at the end?

I believe this to be a valid (albeit ugly) record, yes. Scott's SPF
validator agrees with me; see http://www.kitterman.com/spf/validate.html
and use the 2nd form ("Is this SPF record valid - syntactically correct?")

> And finally, do you recommend using "<dash>-all" instead of."<tilde>~all"
> to stop the spoofing?

Yes, I do. Of course you'd write -all vs. ~all, but on most screens
the difference is hardly noticeable hence me using "<dash>" and "<tilde>".

I'm sure not everybody will agree with me on directly using <dash>-all.

Let me put it this way:
if you use a tilde now, make *very* sure you publish a new record (using
dash) in a couple of days or weeks (depending on the amount of mail you
send). My opinion is that this testing period (because that's what tilde
is for!) is of little use, if at all.

Alex

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 9, 2007, 5:00 AM

Post #11 of 40 (6465 views)
Permalink

Re: SPF syntax correct? [In reply to]

Thanks Alex.

Well, my provider has, magically, now discovered that they can remove the
dot after all, and they have done so. My next task is to get them to remove
"mx" and change the tilde fora dash!

Thanks for all the help

Keith

----- Original Message -----
From: "Alex van den Bogaerdt" <alex[at]ergens.op.het.net>
To: <spf-help[at]v2.listbox.com>
Sent: Tuesday, January 09, 2007 11:53 AM
Subject: Re: [spf-help] SPF syntax correct?

> On Tue, Jan 09, 2007 at 11:29:46AM +0100, eslbase wrote:
>
>> Are you saying that "mx" should go at the end, so that it's like this:
>>
>> "v=spf1 ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
>> ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248
>> ip4:66.232.129.249
>> ip4:66.232.129.250 mx ~all."
>
> No. Basically what I'm saying is that (in your case) mx is equivalent
> to ip4:66.232.130.50 and should be left out.
>
> You are asking us to do this for every incoming connection:
>
> a: "mx":
> a1) DNS lookup the MX record for your domain
> a2) Parse the answer, subtract the host part from it
> a3) DNS lookup the A record for the hostname from (2)
> a4) Compare against the resulting IP address: 66.232.130.50
> continue if no match was found
>
> b: "ip4:66.232.130.50"
> b1) Compare against the specified IP address: 66.232.130.50
> continue if no match was found
>
> See how step a4 and b1 do the same thing? If one matches, so would
> the other, if one does not match, neither will the other. So, why do
> step "a" at all ? Step b is much faster *and* cheaper.
>
> I also made a remark how "ip4" should go up front, in general, to
> avoid unnecessary lookups. In my example, this would mean doing
> 'series' b first, then series a. This saves a couple of DNS lookups
> in case the "ip4" mechanism matches.
>
>
> If you want to keep "mx" (for whatever reason) at least move it to the
> back. Please be aware that everything in front of it would not match
> in case of a forgery, and thus everyone receiving such a forgery would
> be required to lookup your MX host. In other words, you would ask those
> nice people that avoid generating bounces for you, to do additional (and
> more important: useless!) processing.
>
>> Also, If I change the end of my record to look like this:
>>
>> ..."232.129.249 ip4:66.232.129.250 ~all iArna.com=faulty." using the
>> workaround you suggested, will it be valid and therefore solve the
>> problem
>> of the dot at the end?
>
> I believe this to be a valid (albeit ugly) record, yes. Scott's SPF
> validator agrees with me; see http://www.kitterman.com/spf/validate.html
> and use the 2nd form ("Is this SPF record valid - syntactically correct?")
>
>
>> And finally, do you recommend using "<dash>-all" instead
>> of."<tilde>~all"
>> to stop the spoofing?
>
> Yes, I do. Of course you'd write -all vs. ~all, but on most screens
> the difference is hardly noticeable hence me using "<dash>" and "<tilde>".
>
> I'm sure not everybody will agree with me on directly using <dash>-all.
>
> Let me put it this way:
> if you use a tilde now, make *very* sure you publish a new record (using
> dash) in a couple of days or weeks (depending on the amount of mail you
> send). My opinion is that this testing period (because that's what tilde
> is for!) is of little use, if at all.
>
> Alex
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/ or
> http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to
> http://v2.listbox.com/member/?&
>

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 9, 2007, 9:42 AM

Post #12 of 40 (6456 views)
Permalink

Re: SPF syntax correct? [In reply to]

My host is querying my request to remove "mx". Just to confirm, I should
remove "mx" from the record completely, according to your advice below? I
trust your recommendation more than my host's!

Thanks, Keith

----- Original Message -----
From: "Alex van den Bogaerdt" <alex[at]ergens.op.het.net>
To: <spf-help[at]v2.listbox.com>
Sent: Tuesday, January 09, 2007 11:53 AM
Subject: Re: [spf-help] SPF syntax correct?

> On Tue, Jan 09, 2007 at 11:29:46AM +0100, eslbase wrote:
>
>> Are you saying that "mx" should go at the end, so that it's like this:
>>
>> "v=spf1 ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
>> ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248
>> ip4:66.232.129.249
>> ip4:66.232.129.250 mx ~all."
>
> No. Basically what I'm saying is that (in your case) mx is equivalent
> to ip4:66.232.130.50 and should be left out.
>
> You are asking us to do this for every incoming connection:
>
> a: "mx":
> a1) DNS lookup the MX record for your domain
> a2) Parse the answer, subtract the host part from it
> a3) DNS lookup the A record for the hostname from (2)
> a4) Compare against the resulting IP address: 66.232.130.50
> continue if no match was found
>
> b: "ip4:66.232.130.50"
> b1) Compare against the specified IP address: 66.232.130.50
> continue if no match was found
>
> See how step a4 and b1 do the same thing? If one matches, so would
> the other, if one does not match, neither will the other. So, why do
> step "a" at all ? Step b is much faster *and* cheaper.
>
> I also made a remark how "ip4" should go up front, in general, to
> avoid unnecessary lookups. In my example, this would mean doing
> 'series' b first, then series a. This saves a couple of DNS lookups
> in case the "ip4" mechanism matches.
>
>
> If you want to keep "mx" (for whatever reason) at least move it to the
> back. Please be aware that everything in front of it would not match
> in case of a forgery, and thus everyone receiving such a forgery would
> be required to lookup your MX host. In other words, you would ask those
> nice people that avoid generating bounces for you, to do additional (and
> more important: useless!) processing.
>
>> Also, If I change the end of my record to look like this:
>>
>> ..."232.129.249 ip4:66.232.129.250 ~all iArna.com=faulty." using the
>> workaround you suggested, will it be valid and therefore solve the
>> problem
>> of the dot at the end?
>
> I believe this to be a valid (albeit ugly) record, yes. Scott's SPF
> validator agrees with me; see http://www.kitterman.com/spf/validate.html
> and use the 2nd form ("Is this SPF record valid - syntactically correct?")
>
>
>> And finally, do you recommend using "<dash>-all" instead
>> of."<tilde>~all"
>> to stop the spoofing?
>
> Yes, I do. Of course you'd write -all vs. ~all, but on most screens
> the difference is hardly noticeable hence me using "<dash>" and "<tilde>".
>
> I'm sure not everybody will agree with me on directly using <dash>-all.
>
> Let me put it this way:
> if you use a tilde now, make *very* sure you publish a new record (using
> dash) in a couple of days or weeks (depending on the amount of mail you
> send). My opinion is that this testing period (because that's what tilde
> is for!) is of little use, if at all.
>
> Alex
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/ or
> http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to
> http://v2.listbox.com/member/?&
>

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

steve at teamITS

Jan 9, 2007, 9:49 AM

Post #13 of 40 (6457 views)
Permalink

RE: SPF syntax correct? [In reply to]

eslbase <mailto:eslbase[at]eslbase.com> wrote on Tuesday, January 09, 2007
11:42 AM:

> My host is querying my request to remove "mx". Just to confirm, I
should
> remove "mx" from the record completely, according to your advice
below?

If the MX for your domain is already covered by another entry in
your SPF record, there is no need to list it again. It's best to list
each server only once, otherwise you make others look the same
information up repeatedly. See "Common mistakes" below.

-----
SPF FAQ: http://www.openspf.org/FAQ
Common mistakes: http://www.openspf.org/FAQ/Common_mistakes

- Steve Yates
- ITS, Inc.
- Proofread carefully to see if you any words out.

~ Taglines by Taglinator - www.srtware.com ~

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

alex at ergens

Jan 9, 2007, 10:53 AM

Post #14 of 40 (6462 views)
Permalink

Re: SPF syntax correct? [In reply to]

On Tue, Jan 09, 2007 at 06:42:01PM +0100, eslbase wrote:
> My host is querying my request to remove "mx". Just to confirm, I should
> remove "mx" from the record completely, according to your advice below? I
> trust your recommendation more than my host's!

As long as "mx" and "ip4:66.232.130.50" point to the same computer,
including "mx" in your record only wastes resources.

Of course, when things change, so should your record.

Use common sense. It doesn't help to look at the same host twice.
Only if the hostname in your MX record changes a lot, it would make
sense to include "mx" in your record. If only the IP address belonging
to the hostname changes a lot, use "a:the_hostname". If the configuration
is rather static, "ip4:192.0.2.1" is the best.

Usually "mx" is only useful for domains that have multiple MX records
(and I don't mean just two or three).

Alex

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

scott at kitterman

Jan 9, 2007, 10:55 AM

Post #15 of 40 (6465 views)
Permalink

Re: SPF syntax correct? [In reply to]

On Tuesday 09 January 2007 13:53, Alex van den Bogaerdt wrote:

> Usually "mx" is only useful for domains that have multiple MX records
> (and I don't mean just two or three).
>
> Alex
>
But also 10 or fewer:

http://www.openspf.org/RFC_4408#processing-limits

Scott K

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 9, 2007, 11:19 AM

Post #16 of 40 (6512 views)
Permalink

Re: SPF syntax correct? [In reply to]

Thanks for the replies. It's all starting to make sense now!

One more question and then I'll leave you all alone: I just sent an email
to myself as a test, and the header is below. This may be a silly question
and reveal that perhaps it's not yet making sense, but I'm going to ask it
anyway... I see that the header says "Received from 66.232.130.50". That's
fine. But it also says

Received: from cmlapp01.csee.securepod.com ([192.168.80.10])
and
Received: from nombre8c0e0296 (host43-185.pool80116.interbusiness.it
[80.116.185.43])

Does this mean that I need to include these in my SPF record - because I'm
emaling from my local computer?

Many thanks, Keith.

Here's the header:

From eslbase Tue Jan 9 11:10:53 2007
X-Apparently-To: me[at]yahoo.com via 206.190.39.107; Tue, 09 Jan 2007
11:10:58 -0800
X-Originating-IP: [66.232.130.50]
Return-Path: <eslbase[at]eslbase.com>
Authentication-Results: mta144.mail.re2.yahoo.com from=eslbase.com;
domainkeys=neutral (no sig)
Received: from 66.232.130.50 (EHLO cmlapp01.csee.securepod.com)
(66.232.130.50)
by mta144.mail.re2.yahoo.com with SMTP; Tue, 09 Jan 2007 11:10:58 -0800
Received: from localhost (unknown [192.168.80.25])
by cmlapp01.csee.securepod.com (Postfix) with ESMTP
id 24290E3341; Tue, 9 Jan 2007 19:09:08 +0000 (GMT)
Received: from cmlapp01.csee.securepod.com ([192.168.80.10])
by localhost (malware07.securepod.com [192.168.80.20]) (amavisd-new, port
10024)
with LMTP id 10563-02-22; Tue, 9 Jan 2007 13:10:54 -0600 (CST)
Received: from nombre8c0e0296 (host43-185.pool80116.interbusiness.it
[80.116.185.43])
by cmlapp01.csee.securepod.com (Postfix) with ESMTP
id 30DF0E337E; Tue, 9 Jan 2007 19:09:04 +0000 (GMT)
Message-ID: <0bd701c73421$e4b6aa50$c403fea9[at]nombre8c0e0296>
From: "eslbase" <eslbase[at]eslbase.com>
To: <me[at]yahoo.com>
Subject: test
Date: Tue, 9 Jan 2007 20:10:53 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0BD3_01C7342A.43BA92C0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3028
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028
X-Virus-Scanned: by amavisd-new at malware07.securepod.com
Content-Length: 698

----- Original Message -----
From: "Alex van den Bogaerdt" <alex[at]ergens.op.het.net>
To: <spf-help[at]v2.listbox.com>
Sent: Tuesday, January 09, 2007 7:53 PM
Subject: Re: [spf-help] SPF syntax correct?

> On Tue, Jan 09, 2007 at 06:42:01PM +0100, eslbase wrote:
>> My host is querying my request to remove "mx". Just to confirm, I should
>> remove "mx" from the record completely, according to your advice below? I
>> trust your recommendation more than my host's!
>
> As long as "mx" and "ip4:66.232.130.50" point to the same computer,
> including "mx" in your record only wastes resources.
>
> Of course, when things change, so should your record.
>
> Use common sense. It doesn't help to look at the same host twice.
> Only if the hostname in your MX record changes a lot, it would make
> sense to include "mx" in your record. If only the IP address belonging
> to the hostname changes a lot, use "a:the_hostname". If the configuration
> is rather static, "ip4:192.0.2.1" is the best.
>
> Usually "mx" is only useful for domains that have multiple MX records
> (and I don't mean just two or three).
>
> Alex
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/ or
> http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to
> http://v2.listbox.com/member/?&
>

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

scott at kitterman

Jan 9, 2007, 11:21 AM

Post #17 of 40 (6474 views)
Permalink

Re: SPF syntax correct? [In reply to]

On Tuesday 09 January 2007 14:19, eslbase wrote:
> Thanks for the replies. It's all starting to make sense now!
>
> One more question and then I'll leave you all alone: I just sent an email
> to myself as a test, and the header is below. This may be a silly question
> and reveal that perhaps it's not yet making sense, but I'm going to ask it
> anyway... I see that the header says "Received from 66.232.130.50". That's
> fine. But it also says
>
> Received: from cmlapp01.csee.securepod.com ([192.168.80.10])
> and
> Received: from nombre8c0e0296 (host43-185.pool80116.interbusiness.it
> [80.116.185.43])
>
> Does this mean that I need to include these in my SPF record - because I'm
> emaling from my local computer?

No, all SPF cares about is the server it got the message from (the top
received line).

Scott K

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 9, 2007, 11:33 AM

Post #18 of 40 (6458 views)
Permalink

Re: SPF syntax correct? [In reply to]

Thanks Scott.

----- Original Message -----
From: "Scott Kitterman" <scott[at]kitterman.com>
To: <spf-help[at]v2.listbox.com>
Sent: Tuesday, January 09, 2007 8:21 PM
Subject: Re: [spf-help] SPF syntax correct?

> On Tuesday 09 January 2007 14:19, eslbase wrote:
>> Thanks for the replies. It's all starting to make sense now!
>>
>> One more question and then I'll leave you all alone: I just sent an
>> email
>> to myself as a test, and the header is below. This may be a silly
>> question
>> and reveal that perhaps it's not yet making sense, but I'm going to ask
>> it
>> anyway... I see that the header says "Received from 66.232.130.50".
>> That's
>> fine. But it also says
>>
>> Received: from cmlapp01.csee.securepod.com ([192.168.80.10])
>> and
>> Received: from nombre8c0e0296 (host43-185.pool80116.interbusiness.it
>> [80.116.185.43])
>>
>> Does this mean that I need to include these in my SPF record - because
>> I'm
>> emaling from my local computer?
>
> No, all SPF cares about is the server it got the message from (the top
> received line).
>
> Scott K
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/ or
> http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to
> http://v2.listbox.com/member/?&
>

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

bwalton at rawbits

Jan 10, 2007, 6:53 AM

Post #19 of 40 (6448 views)
Permalink

Re: SPF syntax correct? [In reply to]

Also, using MX only makes sense if your inbound mail servers actually
send outbound mail. In many cases (my company, for example - and my
domain hosting company as well) the servers that accept incoming mail
are specialized and do a lot of screening of incoming mail. Other
servers are used to send outbound so MX would specify servers that do
not send outbound mail.

At 10:53 01/09/2007, you wrote:
>Usually "mx" is only useful for domains that have multiple MX records
>(and I don't mean just two or three).

--
Bill Walton bwalton[at]rawbits.com (831)338-0479 home
PO Box 850 (408)721-4346 bus
Boulder Creek, CA 95006-0850 (831)345-7135 cell

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 11, 2007, 3:17 AM

Post #20 of 40 (6482 views)
Permalink

Re: SPF syntax correct? [In reply to]

> On Tue, Jan 09, 2007 at 11:29:46AM +0100, eslbase wrote:
>
>> Are you saying that "mx" should go at the end, so that it's like this:
>>
>> "v=spf1 ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
>> ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249
>> ip4:66.232.129.250 mx ~all."
>
> No. Basically what I'm saying is that (in your case) mx is equivalent
> to ip4:66.232.130.50 and should be left out.
>
> You are asking us to do this for every incoming connection:
>
> a: "mx":
> a1) DNS lookup the MX record for your domain
> a2) Parse the answer, subtract the host part from it
> a3) DNS lookup the A record for the hostname from (2)
> a4) Compare against the resulting IP address: 66.232.130.50
> continue if no match was found
>
> b: "ip4:66.232.130.50"
> b1) Compare against the specified IP address: 66.232.130.50
> continue if no match was found
>
> See how step a4 and b1 do the same thing? If one matches, so would
> the other, if one does not match, neither will the other. So, why do
> step "a" at all ? Step b is much faster *and* cheaper.
>
> I also made a remark how "ip4" should go up front, in general, to
> avoid unnecessary lookups. In my example, this would mean doing
> 'series' b first, then series a. This saves a couple of DNS lookups
> in case the "ip4" mechanism matches.
>
>
> If you want to keep "mx" (for whatever reason) at least move it to the
> back. Please be aware that everything in front of it would not match
> in case of a forgery, and thus everyone receiving such a forgery would
> be required to lookup your MX host. In other words, you would ask those
> nice people that avoid generating bounces for you, to do additional (and
> more important: useless!) processing.
>
>> Also, If I change the end of my record to look like this:
>>
>> ..."232.129.249 ip4:66.232.129.250 ~all iArna.com=faulty." using the
>> workaround you suggested, will it be valid and therefore solve the problem
>> of the dot at the end?
>
> I believe this to be a valid (albeit ugly) record, yes. Scott's SPF
> validator agrees with me; see http://www.kitterman.com/spf/validate.html
> and use the 2nd form ("Is this SPF record valid - syntactically correct?")
>
>
>> And finally, do you recommend using "<dash>-all" instead of."<tilde>~all"
>> to stop the spoofing?
>
> Yes, I do. Of course you'd write -all vs. ~all, but on most screens
> the difference is hardly noticeable hence me using "<dash>" and "<tilde>".
>
> I'm sure not everybody will agree with me on directly using <dash>-all.
>
> Let me put it this way:
> if you use a tilde now, make *very* sure you publish a new record (using
> dash) in a couple of days or weeks (depending on the amount of mail you
> send). My opinion is that this testing period (because that's what tilde
> is for!) is of little use, if at all.
>
> Alex

Thanks to all of you for your help - my host has finally changed my SPF record to

"v=spf1 ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245 ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249 ip4:66.232.129.250 -all"

and this seems to be doing the trick.

One thing though... I sent an email after the SPF was changed, and received the following bounce message:

... while talking to mx.wp.pl.:
>>> MAIL From:<eslbase[at]eslbase.com> SIZE=2114
<<< 550 BLAD SPF - zobacz strone / SPF Error: Please see http://spf.pobox.com/why.html?sender=eslbase%40eslbase.com&ip=213.241.3.158&receiver=smtp.wp.pl Jesli jestes uzytkownikiem poczta.wp.pl sprawdz poprawnosc autoryzacji SMTP / If you are a poczta.wp.pl user check SMTP configuration: http://poczta.wp.pl/autoryzacja/
554 <lektor[at]w.pl>... Service unavailable

I checked the link above and I'm guessing that it was bounced because it was passed through a forwarding service. Is this correct? And if so, more importantly, is this normal?

Many thanks

Keith

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

alex at ergens

Jan 11, 2007, 3:29 AM

Post #21 of 40 (6509 views)
Permalink

Re: SPF syntax correct? [In reply to]

On Thu, Jan 11, 2007 at 12:17:13PM +0100, eslbase wrote:

> Thanks to all of you for your help - my host has finally changed my SPF record to
>
> "v=spf1 ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245 ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248 ip4:66.232.129.249 ip4:66.232.129.250 -all"
>
> and this seems to be doing the trick.

Looking good.

> One thing though... I sent an email after the SPF was changed, and received the following bounce message:
>
> ... while talking to mx.wp.pl.:
> >>> MAIL From:<eslbase[at]eslbase.com> SIZE=2114
> <<< 550 BLAD SPF - zobacz strone / SPF Error: Please see http://spf.pobox.com/why.html?sender=eslbase%40eslbase.com&ip=213.241.3.158&receiver=smtp.wp.pl Jesli jestes uzytkownikiem poczta.wp.pl sprawdz poprawnosc autoryzacji SMTP / If you are a poczta.wp.pl user check SMTP configuration: http://poczta.wp.pl/autoryzacja/
> 554 <lektor[at]w.pl>... Service unavailable
>
> I checked the link above and I'm guessing that it was bounced because it was passed through a forwarding service. Is this correct? And if so, more importantly, is this normal?

I assume you didn't send mail to someone[at]wp.pl but rather to someone[at]polbox.pl
or similar (213.241.3.158 is named xyz.office.polbox.pl)

It was xyz.office.polbox.pl sending a message, and claiming to be you. While
this may be a relative benign form of forgery, it still is considered forgery.

I notice "<lektor[at]w.pl>" in that error message. Is this a typo you introduced?
Let's assume you did; you can forward the message to lektor[at]wp.pl, and at the
same time explain why it is not a good idea for him/her to use a forwarding
service that did not implement SRS, and not have that forwarder whitelisted
at wp.pl It is this user responsible for the link between polbox and wp.
It is this user that needs to solve the problem/get the problem fixed.

Alex

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 11, 2007, 3:45 AM

Post #22 of 40 (6495 views)
Permalink

Re: SPF syntax correct? [In reply to]

>> One thing though... I sent an email after the SPF was changed, and
>> received the following bounce message:
>>
>> ... while talking to mx.wp.pl.:
>> >>> MAIL From:<eslbase[at]eslbase.com> SIZE=2114
>> <<< 550 BLAD SPF - zobacz strone / SPF Error: Please see
>> http://spf.pobox.com/why.html?sender=eslbase%40eslbase.com&ip=213.241.3.158&receiver=smtp.wp.pl
>> Jesli jestes uzytkownikiem poczta.wp.pl sprawdz poprawnosc autoryzacji
>> SMTP / If you are a poczta.wp.pl user check SMTP configuration:
>> http://poczta.wp.pl/autoryzacja/
>> 554 <lektor[at]w.pl>... Service unavailable
>>
>> I checked the link above and I'm guessing that it was bounced because it
>> was passed through a forwarding service. Is this correct? And if so, more
>> importantly, is this normal?
>
> I assume you didn't send mail to someone[at]wp.pl but rather to
> someone[at]polbox.pl
> or similar (213.241.3.158 is named xyz.office.polbox.pl)
>
> It was xyz.office.polbox.pl sending a message, and claiming to be you.
> While
> this may be a relative benign form of forgery, it still is considered
> forgery.
>
> I notice "<lektor[at]w.pl>" in that error message. Is this a typo you
> introduced?
> Let's assume you did; you can forward the message to lektor[at]wp.pl, and at
> the
> same time explain why it is not a good idea for him/her to use a
> forwarding
> service that did not implement SRS, and not have that forwarder
> whitelisted
> at wp.pl It is this user responsible for the link between polbox and wp.
> It is this user that needs to solve the problem/get the problem fixed.
>
> Alex

Thanks Alex. lektor[at]w.pl is not a typo - that's the actual email address I
sent to. So I didn't send either to someone[at]wp.pl or to someone[at]polbox.pl.
Does this make a difference?

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

alex at ergens

Jan 11, 2007, 3:57 AM

Post #23 of 40 (6467 views)
Permalink

Re: SPF syntax correct? [In reply to]

On Thu, Jan 11, 2007 at 12:45:44PM +0100, eslbase wrote:

> >>... while talking to mx.wp.pl.:
> >>>>> MAIL From:<eslbase[at]eslbase.com> SIZE=2114
> >><<< 550 BLAD SPF - zobacz strone / SPF Error: Please see
> >>http://spf.pobox.com/why.html?sender=eslbase%40eslbase.com&ip=213.241.3.158&receiver=smtp.wp.pl

Somehow a computer with address 213.241.3.158 tried to send a message,
using your name, to someone[at]wp.pl

> >>SMTP / If you are a poczta.wp.pl user check SMTP configuration:
> >>http://poczta.wp.pl/autoryzacja/
> >>554 <lektor[at]w.pl>... Service unavailable

Here it says mailbox lektor[at]w.pl is unavailable;

w.pl has an MX record pointing to in.w.pl.
in.w.pl has IP address 213.241.68.197

This IP address is not equal to 213.241.3.158

> Thanks Alex. lektor[at]w.pl is not a typo - that's the actual email address I
> sent to. So I didn't send either to someone[at]wp.pl or to someone[at]polbox.pl.
> Does this make a difference?

You send the message to w.pl, and somehow it should end up at wp.pl
I think you can forgive me for thinking this was a typo :)

In this case it doesn't help contacting lektor[at]w.pl again, it will just
fail again. Try contacting this person via other means.

Alex

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 11, 2007, 4:07 AM

Post #24 of 40 (6440 views)
Permalink

Re: SPF syntax correct? [In reply to]

----- Original Message -----
From: "Alex van den Bogaerdt" <alex[at]ergens.op.het.net>
To: <spf-help[at]v2.listbox.com>
Sent: Thursday, January 11, 2007 12:57 PM
Subject: Re: [spf-help] SPF syntax correct?

> On Thu, Jan 11, 2007 at 12:45:44PM +0100, eslbase wrote:
>
>> >>... while talking to mx.wp.pl.:
>> >>>>> MAIL From:<eslbase[at]eslbase.com> SIZE=2114
>> >><<< 550 BLAD SPF - zobacz strone / SPF Error: Please see
>> >>http://spf.pobox.com/why.html?sender=eslbase%40eslbase.com&ip=213.241.3.158&receiver=smtp.wp.pl
>
>
> Somehow a computer with address 213.241.3.158 tried to send a message,
> using your name, to someone[at]wp.pl
>
>> >>SMTP / If you are a poczta.wp.pl user check SMTP configuration:
>> >>http://poczta.wp.pl/autoryzacja/
>> >>554 <lektor[at]w.pl>... Service unavailable
>
> Here it says mailbox lektor[at]w.pl is unavailable;
>
> w.pl has an MX record pointing to in.w.pl.
> in.w.pl has IP address 213.241.68.197
>
> This IP address is not equal to 213.241.3.158
>
>> Thanks Alex. lektor[at]w.pl is not a typo - that's the actual email address
>> I
>> sent to. So I didn't send either to someone[at]wp.pl or to
>> someone[at]polbox.pl.
>> Does this make a difference?
>
> You send the message to w.pl, and somehow it should end up at wp.pl
> I think you can forgive me for thinking this was a typo :)
>
>
> In this case it doesn't help contacting lektor[at]w.pl again, it will just
> fail again. Try contacting this person via other means.
>
> Alex

...but it's nothing for me to worry about at my end, right?... (I had to
double check it wasn't a typo myself!!)

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

eslbase at eslbase

Jan 15, 2007, 10:06 AM

Post #25 of 40 (6414 views)
Permalink

Re: SPF syntax correct? [In reply to]

>> Thanks to all of you for your help - my host has finally changed my SPF
>> record to
>>
>> "v=spf1 ip4:66.232.130.50 ip4:66.232.135.20 ip4:66.232.129.245
>> ip4:66.232.129.12 ip4:66.232.129.247 ip4:66.232.129.248
>> ip4:66.232.129.249 ip4:66.232.129.250 -all"
>>
>> and this seems to be doing the trick.

The number of bounces I'm getting now with this new SPF record has almost
completely disappeared. I'm experiencing a different problem though - I'm
not sure if it's relevant here - please tell me if it's not.

I sent a test email at emailreach.com and it was flagged by SpamAssassin
apparently because it was sent by a dynamic IP address (82.57.164.222). I'm
in Italy and using Outlook Express, so this is presumably an IP address
given to me by Telecom Italia. I was under the impression that servers
receiving email would ignore this, and only be interested in 66.232.130.50,
the IP of my domain. Am I missing something? If so, how can I overcome
this?

Many thanks, Keith

-------
Archives at http://archives.listbox.com/spf-help/current/ or
http://www.gossamer-threads.com/lists/spf/help/ (easier to search)
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?member_id=1311530&user_secret=5f6145ca

1 2

View All

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com