spf-discuss
[Top] [All Lists]

Re: [spf-discuss] The spammers are using +all

2007-09-06 15:08:20
FYI:

knology.net is a CLEC/ISP/Cable company, much like RCN
and other next generation cable companies that started
selling bundled voice, cable TV, and Internet, long before Comcast
or SBC started doing it.


Regards,

Brian Campbell

From: Scott Kitterman <scott(_at_)kitterman(_dot_)com>
Reply-To: spf-discuss(_at_)v2(_dot_)listbox(_dot_)com
To: spf-discuss(_at_)v2(_dot_)listbox(_dot_)com
Subject: Re: [spf-discuss] The spammers are using +all
Date: Thu, 6 Sep 2007 13:11:08 -0400

On Thursday 06 September 2007 12:50, Marc Chametzky wrote:
> Not only are the spammers using +all, but the more clever ones are using
> several ip4 mechanisms with very broad CIDR specifications so that when
> you put them all together, they end up being ip4:0.0.0.0/0.
>
> While one can detect a Pass being returned by +all easily, doing so with
> an aggregate of ip4's is far more difficult.
>
Which is the exact answer to why there isn't a special rule to disallow +all.

BTW, not all (or even most - or even any of the onese I checked) of the
domains you said were +all in your last message have +all.

knology.net is one good example:

knology.net. 33145 IN TXT "v=spf1 mx ip4:24.214.63.101
ip4:24.214.5.254 ip4:24.214.63.226 ip4:24.214.63.228 ip4:24.214.63.230
ip4:69.73.24.0/24 -all"

From what I can tell they are NOT a spammer domain.

I do think you need to slow down and examine your assumptions and your code
before you start throwing accusations around.

Scott K

-------------------------------------------
-----------------------------------------------------------------------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?list_id=735
Powered by Listbox: http://www.listbox.com

_________________________________________________________________
Test your celebrity IQ.  Play Red Carpet Reveal and earn great prizes! http://club.live.com/red_carpet_reveal.aspx?icid=redcarpet_hotmailtextlink2

-------------------------------------------
-----------------------------------------------------------------------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?list_id=735
Powered by Listbox: http://www.listbox.com