Ian Castle [ian(_dot_)castle(_at_)ecsc(_dot_)co(_dot_)uk] wrote:
Because they don't seem to be right:
# host -t txt computerweekly.ruk1.com
computerweekly.ruk1.com text "v=spf1 ip4:66.35.244.0/24
ip4:66.35.193.0/24 -all"
Yet we are getting mail from 64.69.179.0/24 that looks legit.
Same is true for various other domains...
Yesterday, my mail server SPF-rejected some *definite* spam from
64.69.179.67 claiming to come from lufthansa(_at_)lufthansa(_dot_)ruk1(_dot_)com
("Lufthansa" being a large German airline). The spam was related to the
flight business; I'm not sure though whether it was actually initiated by
Lufthansa (no mention of "Lufthansa" in the subject).