spf-discuss
[Top] [All Lists]

[spf-discuss] not sure how this is happening[Scanned]

2006-01-27 04:03:57
Hi,

our SPF record for the domain analox.net is as follows:

"v=spf1 a mx -all"

Our border MX server is: mailgate.scottishanglo.co.uk (with IP address
80.176.216.242).

In general SPF is workiing well, but recently one of our users has been
receiving spam, apparently from himself. Looking at the mail headers
shows that the person sending is external. The essential part of the
header is shown below:

Received: from 80.176.216.242 ([58.225.123.38]) by
mailgate.scottishanglo.co.uk with Microsoft SMTPSVC(5.0.2195.5329); Wed,
25 Jan 2006 01:23:09 +0000X-Originating-IP: 57.183.224.44 by
smtp.58.225.123.38; Wed, 25 Jan 2006 15:32:43 -0800

As you can see, the sender has given named the sending server with our
IP address. Somehow, this is then passed by our gateway SPF checking
program (MailEssentials 11).

Any ideas how or why this is happening and how to prevent it would be
greatly appreciated.

Kind Regards

Chris Martin
IT Controller
Analox Ltd

-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your 
subscription, 
please go to 
http://v2.listbox.com/member/?listname=spf-discuss(_at_)v2(_dot_)listbox(_dot_)com