You could have blocked this by checking for bogus mx records.
In postfix (main.cf) I use the command:-
smtpd_sender_restrictions =
...
check_sender_mx_access cidr:/etc/postfix/badmxcidr
...
in the file /etc/postfix/badmxcidr I have:-
0.0.0.0/8 550 Invalid Server IP Address for MX of Sender Address
10.0.0.0/8 550 Invalid Server IP Address for MX of Sender Address
127.0.0.0/8 550 Invalid Server IP Address for MX of Sender Address
169.254.0.0/16 550 Invalid Server IP Address for MX of Sender Address
172.16.0.0/12 550 Invalid Server IP Address for MX of Sender Address
192.88.99.0/24 550 Invalid Server IP Address for MX of Sender Address
192.0.2.0/24 550 Invalid Server IP Address for MX of Sender Address
192.168.0.0/16 550 Invalid Server IP Address for MX of Sender Address
192.18.0.0/15 550 Invalid Server IP Address for MX of Sender Address
224.0.0.0/4 550 Invalid Server IP Address for MX of Sender Address
240.0.0.0/4 550 Invalid Server IP Address for MX of Sender Address
See http://rfc-ignorant.org/rfcs/rfc3330.php
dave
----- Original Message -----
From: "Stephane Bortzmeyer" <bortzmeyer(_at_)nic(_dot_)fr>
To: <spf-discuss(_at_)v2(_dot_)listbox(_dot_)com>
Sent: Tuesday, August 03, 2004 7:14 PM
Subject: [spf-discuss] A complicated way to tell we do not send mail
Some domains state they will never send mail:
w3c.org. 172800 IN TXT "v=spf1 -all"
But cedex.net says it in a complicated way:
cedex.net. 85967 IN TXT "v=spf1 mx -all"
And the only MX is...
cedex.net. 85947 IN MX 0 127.0.1.50.
I got a spam(?) claiming to be from cedex.net:
Aug 1 16:39:35 eve postfix/policy-spf[30331]: SPF fail:
smtp_comment=Please see
http://spf.pobox.com/why.html?sender=sina%40cedex.net&ip=218.118.224.195&receiver=eve,
header_comment=eve: domain of sina(_at_)cedex(_dot_)net does not designate
218.118.224.195 as permitted sender
-------
Sender Policy Framework: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
http://www.InboxEvent.com/?s=d --- Inbox Event Nov 17-19 in Atlanta
features SPF and Sender ID.
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname=spf-discuss(_at_)v2(_dot_)listbox(_dot_)com