ateboul at af2a
Mar 19, 2008, 7:50 AM
Post #6 of 7
(1888 views)
Permalink
|
Thank you very much Steve and Michael.
The first string I gave you had been given as an advice by my Registrar (Amen.fr) !!!
Actually I called my ISP and ask them to call me back with a qualified person that could give me the smtp IP addresses my mails go through :
And yes, my Exchange server is configured to use my ISPs SMTP server for all outgoing email. That is already one good thing!
I hope that the spammers don't use the Exchange or ISP's smtp server....
Here is an example of the headers for one of them :
Microsoft Mail Internet Headers Version 2.0
Received: from fx7.security-mail.net ([85.31.212.20]) by mail.af2a.com with Microsoft SMTPSVC(6.0.3790.3959);
Mon, 17 Mar 2008 15:18:40 +0100
Received: from fx72.security-mail.net (unknown [192.168.70.72])
by fx7.security-mail.net (MTA) with ESMTP id 19133B2BBD
for <dernieresminutes [at] af2a>; Mon, 17 Mar 2008 15:20:10 +0100 (CET)
Received: from fx72 (localhost [127.0.0.1])
by fx72.security-mail.net (MTA) with ESMTP id 8AFDD545934
for <dernieresminutes [at] af2a>; Mon, 17 Mar 2008 15:20:06 +0100 (CET)
X-Spam-Score: -
X-Spam-Level:
X-Spam-Status: No, score=x tagged_above=-1000 required=5 WHITELISTED tests=[]
Received: from unknown (unknown [82.84.33.121])
by fx72.security-mail.net (MTA) with SMTP id 9A6E55420FE
for <dernieresminutes [at] af2a>; Mon, 17 Mar 2008 15:20:04 +0100 (CET)
Received: from [82.84.33.121] (port=4528 helo=ppp-82-84-33-121.dialup.tiscali.it)
by europe.security-mail.net with esmtp
id 236c8c-a4709-f9
for dernieresminutes [at] af2a; Mon, 17 Mar 2008 15:19:51 +0100
XX-Message-Id: <47DE7E07.8060601 [at] af2a>
Date: Mon, 17 Mar 2008 15:19:51 +0100
From: "Elbert" <xto [at] af2a>
User-Agent: Thunderbird 2.0.0.9 (Windows/20071031)
MIME-Version: 1.0
To: "Jacklyn" <dernieresminutes [at] af2a>
Subject: reater stamina in bed,
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Message-Id: <20080317142005.9A6E55420FE [at] fx72>
X-Virus-Scanned: by Security-Mail
Message-Id: <20080317142010.19133B2BBD [at] fx7>
Return-Path: xto [at] af2a
X-OriginalArrivalTime: 17 Mar 2008 14:18:40.0469 (UTC) FILETIME=[CC737050:01C88839]
Thanks again for your time.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Alexandre Teboul
Responsable Systèmes d'Information
Tel: 01 56 88 56 17
Fax: 01 56 88 56 10
http://www.af2a.com
P Pensez à l'environnement avant d'imprimer ce message
-----Message d'origine-----
De : Michael Breton [mailto:michael [at] breton]
Envoyé : mercredi 19 mars 2008 15:28
À : spf-help [at] v2
Objet : Re: [spf-help] SPF configuration
> We have a domain called af2a.com who is victim from spam sent from whatever [at] af2a
>
>
>
>
>
> My DNS is on my French Registrar Amen
>
> We have an exchange server that send the mails through our ISP smtp : static.magiconline.fr
>
>
>
> On my DNS admin control panel : have generated this string :
>
> af2a.com. IN TXT "v=spf1 ~all"
>
>
>
> Do you think it's ok ?
>
> Do I have to had the ISP smtp that sends mails for us in a A: or MX: field ?
>
> Is it dangerous ?
>
>
>
That SPF record you show "v=spf1 ~all" says all email from the af2a.com
domain should be suspected of being spam. This record will not help you
at all.
First thing you should do, is make sure your server itself isn't being
used by the spammers. If it is, then there is nothing that SPF can do
to prevent that. Same thing with your ISPs SMTP server. If their
server were being utilized to send the spam, then your SPF record would
not help prevent this abuse.
If you have a copy of the full headers from some of the spam in
question, that would help determine if it is going through your server
or your ISP's server.
Now to SPF:
If your Exchange server is using your ISPs SMTP server for all outgoing
email, then you should speak with your ISP about what your SPF record
should look like.
It looks like the email you sent to the list came from 195.154.193.36,
and if all your email always originates from just that single IP address
(Ask them), then the best SPF record for your domain, would be this
one: (Assuming your Exchange server sends all outgoing mail to your ISP.
af2a.com. IN TXT "v=spf1 ip4:195.154.193.36 ~all"
And once you know it is working well, you would change the "~all" to
"-all". You probably will not notice any reduction in spammers using
your domain to send their junk until it is changed to "-all". And you
won't notice any reduction at all if they are using either your server
or your ISPs server to send their stuff.
Hope this helps...
Michael Breton
-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: http://www.listbox.com/member/archive/1020/=now
RSS Feed: http://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com
-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: http://www.listbox.com/member/archive/1020/=now
RSS Feed: http://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com
|
