Hi there Folks
Over the last 2 week I've got ALOT of the same spam (Stock Spam) of a
certain kind (to spamtrap addresses)
but its all coming from forged from addresses with SPF records wtih ?all.
(100's of them, most from different forged from addresses) Stock spam with
attached FAX image of information about a certain Stock)
freehotstars.com
tenderizer.net
sveskebanden.dk
stowdata.co.uk
worldzen.com
1000brides.com
ghcook.com
belldiver.trix.net
dakross.co.uk
Example:
Received-SPF: neutral (mx5.orcon.net.nz: 218.45.167.112 is neither permitted
nor denied by domain of gummgovdo(_at_)dakross(_dot_)co(_dot_)uk)
dakross.co.uk text = "v=spf1 ip4:212.124.192.0/19 ?all"
So does this mean spammers are getting smarter and sending out this batch of
spam from domains which only have ?all (returning neutral only) (note I've
never had this spam from domains which have pass or none as return codes).
So they hope antispam systems will see the domain has SPF rules and make it
less spam
Or are more and more people putting in SPF information but using ?all (so
the SPF rules mean nothing).
My spam software picks up all the spam even with this in it but it looks
like the spammers are doing it purpose.
Thanks
Craig
-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-discuss(_at_)v2(_dot_)listbox(_dot_)com