Mailing List Archive: SPF: Help

CID2SPF

Index | Next | Previous | View Threaded

leonard.gray at srs

Jul 7, 2004, 4:53 AM

Post #1 of 4 (1005 views)
Permalink

CID2SPF

Sorry if this has been asked ad-nauseum, but I'm new to the list, new to
SPF (just got it up and running).

In running initial tests, the sample "mengwong [at] vw" appears to
work ok, but it also looks like that address is hardwired into SPF to
produce a predetermined response. It doesn't LOOK like any type of DNS
lookup is being performed. Needless to say, forged addresses from sites
that I believe have SPF recs published do not reject. I have the CID2SPF
module installed as well.

Is there anyway to debug SPF to determine just what I'm running into?
Running Sendmail 8.12.11, using the sendmail-milter method, perl 5.8.3,
and all required perl modules build per sendmail-minter-install.txt.

Thanks for any help!

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help [at] v2

spf at metro

Jul 7, 2004, 11:19 AM

Post #2 of 4 (991 views)
Permalink

Re: CID2SPF [In reply to]

On Wed, Jul 07, 2004 at 07:53:58AM -0400, leonard.gray [at] srs wrote:
> In running initial tests, the sample "mengwong [at] vw" appears to
> work ok, but it also looks like that address is hardwired into SPF to
> produce a predetermined response. It doesn't LOOK like any type of DNS
> lookup is being performed. Needless to say, forged addresses from sites
> that I believe have SPF recs published do not reject. I have the CID2SPF
> module installed as well.

It doesn't LOOK like it, but what is actually going on? Can you check
the logs of your (caching?) dns? Do you have a dns at all. What leads
you to the conclusion that it 'LOOKS' like any type of dns lookup is
being performed??

What are sites that you 'believe' have spf recs? Did you actually do a
dig/nslookup/host to see if they actually have SPF records or not, and
if so, what these records are?

Koen

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help [at] v2

leonard.gray at srs

Jul 7, 2004, 11:30 AM

Post #3 of 4 (918 views)
Permalink

Re: CID2SPF [In reply to]

Sorry for the previous babbling. I've learned tons in the last few hours.

Most of the failures I *thought* were occurring were returning "neutral"
as they're in transition. I checked the "high profile" domain list at
spf.pobox.com, ran manual nslookups, and found the transitional, soft, and
hard fail sites. SPF is working perfectly. Even hotmail and microsoft
return "neutral" for now, which I suppose will change in time.

Thanks for your response!

Koen Martens <spf [at] metro>
Sent by: owner-spf-help [at] v2
07/07/2004 02:19 PM
Please respond to
spf-help [at] v2

To
spf-help [at] v2
cc

Subject
Re: [spf-help] CID2SPF

On Wed, Jul 07, 2004 at 07:53:58AM -0400, leonard.gray [at] srs wrote:
> In running initial tests, the sample "mengwong [at] vw" appears
to
> work ok, but it also looks like that address is hardwired into SPF to
> produce a predetermined response. It doesn't LOOK like any type of DNS
> lookup is being performed. Needless to say, forged addresses from sites
> that I believe have SPF recs published do not reject. I have the
CID2SPF
> module installed as well.

It doesn't LOOK like it, but what is actually going on? Can you check
the logs of your (caching?) dns? Do you have a dns at all. What leads
you to the conclusion that it 'LOOKS' like any type of dns lookup is
being performed??

What are sites that you 'believe' have spf recs? Did you actually do a
dig/nslookup/host to see if they actually have SPF records or not, and
if so, what these records are?

Koen

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname=spf-help [at] v2

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help [at] v2

wayne at midwestcs

Jul 7, 2004, 11:55 AM

Post #4 of 4 (986 views)
Permalink

Re: CID2SPF [In reply to]

In <OF8F4A2613.2384FC92-ON85256ECA.0040AD05-85256ECA.00415DBB [at] srs> leonard.gray [at] srs writes:

> I have the CID2SPF
> module installed as well.

For what it is worth, I recommend not using the CID2SPF module for one
simple reason: almost no one is publishing only MicroSoft's Caller-ID
records.

This is based on a couple of surveys I've done on 1.3 million email
domains, the most recent was a couple of weeks ago. (I posted results
to the SPF-discuss and the IETF MARID lists). I found only a couple
dozen domains that published Caller-ID exclusively, only three of
which have any significant email traffic. Those three are
hotmail.com, microsoft.com and exchange.microsoft.com.

In the month between my first and second surveys, I found only three
new domains publishing Caller-ID information (compared with thousands
of new SPF publishers). MicroSoft is abandonding the Caller-ID spec
in favor of the newer (and better) Sender-ID spec, which is still
going through developement in the IETF. It appears that Sender-ID
will use the SPF records as its basis instead of the Caller-ID
records.

Basically, using CID2SPF is a waste of time/resources and will almost
certainly become even less useful in the future.

If you are using SPF for whitelisting, instead of just rejecting
forged email, then I would recommend using the perl M:S:Q's and/or
libspf2's (aka libspf-alt) "override" functionality to create SPF
records for Hotmail and Microsoft.

-wayne

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help [at] v2

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads