spf-discuss
[Top] [All Lists]

Re: [spf-discuss] Re: Beginners questions about SPF

2008-02-02 13:24:29
Hi Frank,

3. I thought it was somehow authenticated because I received this message, 
while message I sent in 4 never arrived. Maybe Hotmail is not authenticating 
it, but it must somehow validate it.

4. Hotmail seems to have received this message (Please see below), but it never 
showed up in my inbox. I'm actually not sending this message from testing.com 
domain, and though that maybe Hotmail could be comparing the sender's ip 
address with the ip address returned by "nslookup testing.com" to determine 
it's a spam.

Andre

************************************************
andre(_at_)kirchner:~$ telnet mx4.hotmail.com 25
Trying 65.54.244.232...
Connected to mx4.hotmail.com.
Escape character is '^]'.
220 bay0-mc7-f2.bay0.hotmail.com Sending unsolicited commercial or bulk e-mail 
to Microsoft's computer network is prohibited. Other restrictions are found at 
http://privacy.msn.com/Anti-spam/. Violations will result in use of equipment 
located in California and other states. Sat, 2 Feb 2008 12:16:29 -0800 

EHLO testing.com
250-bay0-mc7-f2.bay0.hotmail.com (3.5.0.22) Hello [76.77.66.100]
250-SIZE 29696000
250-PIPELINING
250-8bitmime
250-BINARYMIME
250-CHUNKING
250-AUTH LOGIN
250-AUTH=LOGIN
250 OK

MAIL FROM: andre(_at_)testing(_dot_)com
250 andre(_at_)testing(_dot_)com(_dot_)(_dot_)(_dot_)(_dot_)Sender OK

RCPT TO: kirchnerandre(_at_)hotmail(_dot_)com
250 kirchnerandre(_at_)hotmail(_dot_)com 

DATA
354 Start mail input; end with <CRLF>.<CRLF>
From: andre <testing.com>
      To: Andre Kirchner <kirchnerandre(_at_)hotmail(_dot_)com>
      Subject: SMTP test
      
      SMTP test body

.
250 
<BAY0-MC7-F2kzYDGj9C000b5882(_at_)bay0-mc7-f2(_dot_)bay0(_dot_)hotmail(_dot_)com>
 Queued mail for delivery

QUIT
221 bay0-mc7-f2.bay0.hotmail.com Service closing transmission channel
Connection closed by foreign host.

************************************************



----- Original Message ----
From: Frank Ellermann <nobody(_at_)xyzzy(_dot_)claranet(_dot_)de>
To: spf-discuss(_at_)v2(_dot_)listbox(_dot_)com
Sent: Saturday, February 2, 2008 11:51:47 AM
Subject: [spf-discuss] Re: Beginners questions about SPF


Andre 
Kirchner 
wrote:
 

1. 
Is 
there 
a 
SPF 
server 
where 
a 
domain 
must 
register 
its 
mail

server 
and 
email 
addresses?

No.  
There's 
an 
FAQ 
on 
<http://www.openspf.org> 
and 
a 
dedicated
SPF 
Help 
list 
(just 
replace 
"discuss" 
by 
"help" 
in 
the 
address).

You 
put 
sender 
policies 
in 
DNS 
records 
(TXT 
and/or 
the 
new 
SPF
record 
type) 
at 
your 
domain 
provider 
- 
where 
you 
have 
all 
your
other 
DNS 
records, 
MX, 
A, 
etc.


2. 
An 
email 
server 
that 
received 
a 
message 
from 
aaa(_at_)yyy(_dot_)com,

and 
uses 
sender 
ID 
framework 
(SIDF) 
to 
authenticate 
messages.

While 
SenderID 
(PRA) 
uses 
the 
same 
syntax 
as 
SPF 
for 
policy
records, 
the 
semantics 
is 
rather 
different, 
SenderID 
(PRA) 
is
not 
directly 
related 
to 
SMTP, 
it 
is 
based 
on 
email 
headers.


Will 
it 
compare 
the 
hostname 
of 
the 
email 
server 
of 
domain

yyy.com 
(which 
is 
mailserver.yyy.com) 
with 
the 
hostname

name 
registered 
in 
a 
SPF 
server?

I 
fear 
none 
of 
the 
SPF 
lists 
can 
answer 
what 
SenderID 
(PRA)
checking 
servers 
generally 
do.  
As 
far 
as 
they 
follow 
the
PRA 
specification 
they 
figure 
out 
a 
PRA 
in 
the 
email 
header
(an 
address 
in 
the 
From 
/ 
Sender 
/ 
Resent 
header 
fields 
as
specified 
in 
RFC 
4407), 
take 
the 
RHS 
(domain) 
of 
this 
PRA,
fetch 
a 
SenderID 
PRA 
policy 
DNS 
record 
(using 
the 
strategy
defined 
in 
RFC 
4408 
for 
SPF), 
evaluate 
it 
(again 
doing 
what
SPF 
would 
do), 
and 
get 
a 
result 
PASS 
/ 
FAIL 
/ 
NEUTRAL 
/ 
...


3. 
I 
have 
a 
hotmail 
account, 
and 
I 
know 
Hotmail 
uses 
SIDF

to 
authenticate 
messages.

Better 
ask 
them 
what 
they 
do, 
it 
might 
be 
unrelated 
to 
both
SenderID 
(PRA) 
or 
SPF.  
If 
you 
dig 
in 
the 
SPF 
HELP 
archive
you 
find 
that 
the 
operations 
of 
hotmail 
were 
a 
big 
mystery.


I 
receive 
a 
message 
from 
viff(_at_)viff(_dot_)org, 
but 
viff.org 
does

not 
have 
a 
SPF 
record

FWIW 
they 
also 
have 
no 
SenderID 
(PRA) 
policy.  


How 
did 
Hotmail 
authenticated 
it?

Why 
do 
you 
think 
they 
did, 
did 
the 
viff.org 
mail 
arrive 
with
a 
Received-SPF 
header 
field 
in 
your 
hotmail 
inbox 
?


4. 
I 
used 
the 
following 
commands 
to 
send 
me 
a 
message, 
but

didn't 
receive 
it. 
Why 
did 
I 
received 
this 
message 
from 

viff(_at_)viff(_dot_)org, 
but 
not 
the 
following 
one?

testing.com 
also 
has 
no 
SPF 
or 
FWIW 
SenderID 
(PRA) 
policy.
Did 
hotmail 
accept 
your 
test 
mail 
?  
You 
only 
showed 
one
direction 
of 
the 
telnet 
session, 
not 
the 
hotmail 
replies.

 
Frank

-------------------------------------------
Sender 
Policy 
Framework: 
http://www.openspf.org
Archives: 
http://v2.listbox.com/member/archive/735/=now
RSS 
Feed: 
http://v2.listbox.com/member/archive/rss/735/
Modify 
Your 
Subscription: 
http://v2.listbox.com/member/?&;
Powered 
by 
Listbox: 
http://www.listbox.com





      
____________________________________________________________________________________
Be a better friend, newshound, and 
know-it-all with Yahoo! Mobile.  Try it now.  
http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ 

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Archives: http://v2.listbox.com/member/archive/735/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/735/
Modify Your Subscription: 
http://v2.listbox.com/member/?member_id=2183229&id_secret=93034881-de6034
Powered by Listbox: http://www.listbox.com

<Prev in Thread] Current Thread [Next in Thread>