spf-discuss
[Top] [All Lists]

Re: spam from pobox

2004-09-12 18:33:37
I use to have problems with pobox.com too.
I had blocked few IPs, but few users complained about that.

Solution = make my filters hard for pobox stuff.


On Sun, 12 Sep 2004 11:02:34 +0100, David Woodhouse 
<dwmw2(_at_)infradead(_dot_)org> wrote:
On Sat, 2004-09-11 at 15:44 -0400, Meng Weng Wong wrote:
On Sat, Sep 11, 2004 at 12:29:52PM -0400, John Keown wrote:
| Received: from ruby.pobox.com (localhost [127.0.0.1])
| by ruby.pobox.com (Postfix) with ESMTP id C820527D2
| for <sidewin(_at_)ot(_dot_)com>; Sat, 11 Sep 2004 12:09:42 -0400 (EDT)
| Delivered-To: marsu(_at_)pobox(_dot_)com
| Received: from ruby (localhost [127.0.0.1])
| by ruby.pobox.com (Postfix) with ESMTP id B94682580
| for <marsu(_at_)pobox(_dot_)com(_dot_)07943725(_dot_)001(_dot_)icgmh>; 
Sat, 11 Sep 2004 12:09:42 -0400
| (EDT)

Pobox.com is a forwarding service.  People pay us a
subscription fee to have aliases @pobox.com that forward to
an external address.

But that spam actually bears a MAIL FROM address @pobox.com and gets an
SPF 'PASS'. It definitely appears to have come from pobox.com.

Since the invalid¹ address <sammydorn(_at_)womensmail(_dot_)net> has no SPF 
record
surely the pobox mail servers should not have given it _more_
'legitimacy' by rewriting the address?

My SRS implementation rewrites only when the original sender domain
actually publishes an SPF record (and also only if the recipient is
known to check SPF).

Is there an option for your customers to turn off SRS?

--
dwmw2

¹ 554 Recipient Rejected: Not accepting mail for this account : Account 
Inactive




-------
Sender Policy Framework: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
http://www.InboxEvent.com/?s=d --- Inbox Event Nov 17-19 in Atlanta features 
SPF and Sender ID.
To unsubscribe, change your address, or temporarily deactivate your 
subscription,
please go to 
http://v2.listbox.com/member/?listname=spf-discuss(_at_)v2(_dot_)listbox(_dot_)com



<Prev in Thread] Current Thread [Next in Thread>