ianw at graticule
May 2, 2008, 4:30 AM
Post #6 of 8
(766 views)
Permalink
|
Alex,
Thanks for that explanation, all makes sense. I've looked it up on
google and appears to be one of the main reasons people advise against
using SPF. I'm guessing there isn't really a way around this as yet?
Would it make any difference if I changed my SPF record to "~all"
instead of "-all" which I believe adds more checks rather than just a
blanket ban on mail not from the given SPF record addresses?
Ian
> On Fri, May 02, 2008 at 09:29:43AM +0100, Ian Wright wrote:
>
>> I'm wondering if anyone can provide me with any assistance on the
>> following problem? Any help would be much appreciated.
>>
>> We started getting an overload of fraudlant emails caliming to be from
>> graticule.com and therefore I decided to set up an SPF record to try and
>> prevent this. This has prevented most of the emails, however we are
>> getting the occasional message bounce back saying it was undeliverable
>> because it failed an SPF check. I don't understand why/where this source
>> IP address is coming from, and therefore am not sure how to go about
>> resolving the issue.
>>
>> The SPF record is setup to allow both our office mail server and our
>> ISP's servers to send mail:
>> v=spf1 ip4:62.241.162.1/24 ip4:81.86.72.99 a mx -all/
>>
>> The error message is as follows:
>>
>> /"The following message to <aaaa[at]bbbb.com> was undeliverable.
>> The reason for the problem:
>> 5.1.0 - Unknown address error 550-'"Mail from graticule.com is denied
>> from host 212.74.114.38 SPF"' /
>>
>> -----------------------------------------------------------
>> /Reporting-MTA: dns; mk-outboundfilter-2.mail.uk.tiscali.com
>>
>> Final-Recipient: rfc822;aaaa[at]bbbb.com
>> Action: failed
>> Status: 5.0.0 (permanent failure)
>> Remote-MTA: dns; [212.53.64.43]
>> Diagnostic-Code: smtp; 5.1.0 - Unknown address error 550-'"Mail from
>> graticule.com is denied from host 212.74.114.38 SPF"' (delivery
>> attempts: 0)"/
>>
>> Our IP address however is 81.86.72.99 or 81-86-72-99.dsl.pipex.com and
>> have our own mail server, so I can understand where this 212.74.114.38
>> is coming from...
>>
>> In case it helps, the email header is as follows:
>>
>> /Subject: ------------- Removed -------------
>> From: Graticule Sales <sales[at]graticule.com>
>> Date: Thu, 01 May 2008 10:14:02 +0100
>> To: "aaaa[at]bbbb.com" <aaaa[at]bbbb.com>
>>
>
>
>> Received: from galaxy.systems.pipex.net ([62.241.162.31]) by
>> smtp.pipex.tiscali.co.uk with ESMTP; 01 May 2008 10:14:03 +0100
>>
>
> If you can trust smtp.pipex.tiscali.co.uk, this means the message
> was routed through 62.241.162.31
>
> This is the last added Received: header line.
>
> According to the error message, 212.53.64.43 refuses to accept the
> message, because 212.74.114.38 claims to be sending in name of
> sales[at]graticule.com
>
>
> Looking at DNS:
>
> 43.64.53.212.in-addr.arpa. 28800 IN PTR relay1.netnames.net.
> 38.114.74.212.in-addr.arpa. 900 IN PTR mk-outboundfilter-2.mail.uk.tiscali.com.
>
> This probably means someone at tiscali received the message, and
> then decided to transmit a copy ("forward") to another address.
> That other address has an MX at netnames.net, which detected a mismatch
> between your domain name and the sending host.
>
> If I'm right, this is an example of the forwarder's problem
> (known as the forwarder problem).
>
>
> Again, in other words:
>
> You sent a message to someone[at]tiscali without any problems.
>
> That someone[at]tiscali forwards his/her mail to elsewhere, but uses
> your name to do so.
>
> That elsewhere is aware of SPF, and refuses the message.
> Tiscali cannot deliver the message, needs to do something, and
> returns it not to the true sender but to you.
>
> In this example case the message is delivered to the originator of the
> original message, but it could easily have been a forged message which
> then is "returned" to you.
>
>
> HTH
> Alex
>
> -------------------------------------------
> Sender Policy Framework: http://www.openspf.org
> Modify Your Subscription: http://www.listbox.com/member/
> Archives: http://www.listbox.com/member/archive/1020/=now
> RSS Feed: http://www.listbox.com/member/archive/rss/1020/
> Powered by Listbox: http://www.listbox.com
>
--
*Ian Wright*
/Software Developer
ianw[at]graticule.com /
* Graticule <http://www.graticule.com>
* 01132 344000
-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: http://www.listbox.com/member/archive/1020/=now
RSS Feed: http://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com
|
