Mailing List Archive: SPF: Help

SPF DNS error help

Index | Next | Previous | View Threaded

Joey at Web56

May 28, 2009, 8:40 AM

Post #1 of 4 (1659 views)
Permalink

SPF DNS error help

Hello all,

Is the dns lookup limit a default of SPF and everyone using spf has the
same, or is controlled per server?

Messages get through to our server, looking like they are from us, but of
course it's not.

I have tested the spf record using online tools and it seems to pass those
tests linked from openspf.org, I believe the reason here is because I put in
either a real ip of ours ( match ip4 ) or one that's not ours ( fail ).
Guessing that's why it's not failing there, no DNS lookups.

My own server gives me the below error which then doesn't reject the message
and lets it through:

Received-SPF: permerror (mydomain.com: Maximum void DNS look-ups limit (2)
exceeded) receiver=myserver.mydomain.com; identity=mailfrom;
envelope-from="mike [at] mydomain"; helo="[190.9.95.66]";
client-ip=190.9.95.66

Received: from [190.9.95.66] (unknown [190.9.95.66])

by myserver.mydomain.com (Postfix) with ESMTP id CE79C264013

for <mike [at] mydomain>; Thu, 28 May 2009 11:12:31 -0400
(EDT)

Message-Id: OWKYIJ80492.13AE1B5@[190.9.95.66]

Since I am using IP4 for all of our servers I know that's not the problem,
we do have the following which I believe may be the problem:

ptr:notify-customer.com ptr:enom.com ptr:opensrs.com

They do send message as us at times, so we need to allow them, however they
don't have the information to provide specifically what servers are sending
out messages.

Plugging in the real information from above ( only my doman is concealed )
into Beveridge Hosting - SPF Test I get the following:

fail Please see
http://www.openspf.org/why.html?sender=mike%40mydomain.com&ip=190.9.95.66&re
ceiver=tools.bevhost.com tools.bevhost.com: domain of mike [at] mydomain does
not designate 190.9.95.66 as permitted sender v=spf1 a:earth.mydomain.com
ip4:200.200.100.0/23 ptr:notify-customer.com ptr:enom.com ptr:opensrs.net
-all HASH(0x8a80780)

So this looks like my record is working perfectly, but am at a loss on how
to resolve this, and want to insure we are not screwing real messages in the
process on other servers.

We are using Mail::SPF -- v2.006 from cpan.

In our postfix install we have in main.cf: check_policy_service
unix:private/policy

In master.cf we have:

policy unix - n n - - spawn

user=nobody argv=/usr/local/lib/policyd-spf-perl

I appreciate your help with this issue which is driving me nuts!

Joey

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

spf at beer

May 28, 2009, 8:52 AM

Post #2 of 4 (1597 views)
Permalink

Re: SPF DNS error help [In reply to]

> Is the dns lookup limit a default of SPF and everyone using spf has the
> same, or is controlled per server?

Huh?

I can't actually parse that question. What are you asking?

> Messages get through to our server, looking like they are from us, but of
> course it's not.

Have you published a SPF record?
Have you installed a SPF filter?

Both of the above are necessary for SPF rejection.

> My own server gives me the below error

I doubt it.

> which then doesn't reject the message and lets it through:
>
> Received-SPF: permerror (mydomain.com: Maximum void DNS look-ups limit (2)

mydomain.com doesn't have a SPF record, so you'll not get any rejections
if it is forged.

So if you are really a representative of Dotster, you might want to fix
your DNS. If you'renot, you don't really get a lot of say in how
mydomain.com sends its email...

> Since I am using IP4 for all of our servers I know that's not the problem,
> we do have the following which I believe may be the problem:
>
> ptr:notify-customer.com ptr:enom.com ptr:opensrs.com

ptr is usually a problem. UNless you have a *really* good reason for using
it, you shouldn't.

> They do send message as us at times, so we need to allow them

Do you permit them to forge your domain?

That's probably the real issue...

> ( only my doman is concealed )

...Which means we cannot help you. We cannot see any of your records,
check any of your config, or anything else for that matter. If you don't
tell us who you are, we can't tell you why someone is able to forge your
domain.

Vic.

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

vesely at tana

May 28, 2009, 9:06 AM

Post #3 of 4 (1589 views)
Permalink

Re: SPF DNS error help [In reply to]

Joey wrote:
> Is the dns lookup limit a default of SPF and everyone using spf has the
> same, or is controlled per server?

Both.

RFC 4408 says:
SPF implementations MUST limit the number of mechanisms and modifiers
that do DNS lookups to at most 10 per SPF check

You need to check your implementation...

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

rob.macgregor at gmail

May 28, 2009, 9:28 AM

Post #4 of 4 (1595 views)
Permalink

Re: SPF DNS error help [In reply to]

On Thu, May 28, 2009 at 16:40, Joey <Joey [at] web56> wrote:
> Hello all,
<---SNIP--->
> Messages get through to our server, looking like they are from us, but of
> course it's not.

As was said before, because you're hiding your real domain, and don't
mention your actual SPF record, it's pretty much impossible to help
you with any detail. If you don't want to publicise your domain, use
the form on the SPF site to request help from a volunteer.

> Since I am using IP4 for all of our servers I know that's not the problem,
> we do have the following which I believe may be the problem:
>
> ptr:notify-customer.com ptr:enom.com ptr:opensrs.com

As mentioned in the Record Syntax page, you should avoid the use of
ptr: where at all possible.

> They do send message as us at times, so we need to allow them, however they
> don't have the information to provide specifically what servers are sending
> out messages.

Then lean on them to provide that information, or require them to use
a sub-domain of yours.

> We are using Mail::SPF -- v2.006 from cpan.

Note that the last time you posted your problem was highlighted by one
poster, as was the fact that without your real domain we can't help
you. See http://tinyurl.com/lp6blx

--
Please keep list traffic on the list.

Rob MacGregor
Whoever fights monsters should see to it that in the process he
doesn't become a monster. Friedrich Nietzsche

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads