On 2006-06-06 14:30, william(at)elan.net wrote:
On Tue, 6 Jun 2006, Kurt Andersen wrote:
Inspecting the queries shows that in March, spammers started using the
SPF-record-only domain for our "no mail sent from this domain" for their
garbage and usage has increased from zero to over 300 queries a day
now. It's ironic that they would latch onto an SPF record to try an
exploit like this.
Are they using these domains in addresses in RFC2821 MAIL FROM or in
header field From: ?
2821 (unless these happen to be doing some sort of SID/PRA lookups) - I
just see the queries from the macro expansion lookup on the SPF v1
records that we publish.
--Kurt
--
Kurt Andersen <kurta(_at_)agilent(_dot_)com>
Agilent Technologies Postmaster
Global Messaging Team, Agilent Technologies
+1 (509) 921-3792
-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname=spf-discuss(_at_)v2(_dot_)listbox(_dot_)com