spf-discuss
[Top] [All Lists]

Re: [spf-discuss] Re: Election issue: forwarding problem

2007-01-27 10:47:46
At 12:13 PM 1/27/2007 -0500, you wrote:

On Sat, 27 Jan 2007, David MacQuigg wrote:

> Most small companies now use a spam appliance, like the Barracuda box we
> have at U of A.  These seem to be very "user friendly" in providing a nice
> web interface for whitelisting and blacklisting.

I get a constant stream of spam from barracudas.  Like this, only several
times a minute:

2007Jan27 00:57:29 [399] connect from navgw2.affinitygroup.com at ('12.17.223.118', 41374) EXTERNAL
2007Jan27 00:57:29 [399] hello from den-barracuda.affinitygroup.com
2007Jan27 00:57:29 [399] mail from <> ('SIZE=2516',)
2007Jan27 00:57:29 [399] Received-SPF: none (mail.bmsi.com: 12.17.223.118 is neither permitted nor denied by domain of den-barracuda.affinitygroup.com) client_ip=12.17.223.118; helo=den-barracuda.affinitygroup.com; receiver=mail.bmsi.com; identity=helo
2007Jan27 00:57:29 [399] X-Guessed-SPF: neutral
2007Jan27 00:57:29 [399] rcpt to <rkmna(_at_)bmsaix(_dot_)bmsi(_dot_)com> ()
2007Jan27 00:57:29 [399] REJECT: bounce with no SRS encoding

The only good thing is that they have *finally* started using real
DSNs instead of replies, so at least I am rejecting them in SMTP
envelope now.  I would actually be impressed if they checked SPF and
rejected SPF FAIL.  (Although maybe that is a config option, and I
just never see mail from boxes that are configured that way.)

OK, this is excellent input for my list of services with mail-handling problems. I wasn't aware of this, probably because my domains are too small for spammers to use as forged return addresses, and I'm only on the recipient side of this firewall.

Barracuda Spam Firewall - sends "bounce spam" to forged return addresses. This can get your IP blacklisted.

Have I summarized this correctly? I'll keep your post above in my file, in case anyone asks for specifics on why Barracuda is listed as having problems.

Any more candidates - either spam appliances or email services that the public might subscribe to?

-- Dave


-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your subscription, please go to http://v2.listbox.com/member/?list_id=735

<Prev in Thread] Current Thread [Next in Thread>