spf-discuss
[Top] [All Lists]

Re: [spf-discuss] Obivous forged email reply with bad SPF info... Here is a header...

2008-08-01 01:42:49
Boyd Lynn Gerber wrote:

[...] now I have received 2000 of these emails...

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                        The Postfix program

<dsha(_at_)jetbrains(_dot_)com>: host mail.intellij.net[213.182.181.98] said: 
550
Please%see%http://spf.pobox.com/why.html?sender=gerber%40zenez.com&ip=83
.149.198.201&receiver=is.intellij.net
    : Reason: mechanism (#5.7.1) (in reply to MAIL FROM command)

but nothing more than this...

The bounce is apparently generated by smtp.ispras.ru after intellij.net
rejected the message. Correctly, since they are the MX of jetbrains.com,
and SPF test fails. Obviously, smtp.ispras.ru does no SPF checks...


Perhaps someone should advise the postmaster at intellij.net (in CC)
that the url they have configured results in

HTTP/1.1 301 Moved Permanently
Date: Fri, 01 Aug 2008 07:48:56 GMT
Server: Apache/2.0.55 (Debian) DAV/2 SVN/1.3.2 mod_ssl/2.0.55 OpenSSL/0.9.8g 
mod_apreq2-20051231/2.6.0 mod_perl/2.0.2 Perl/v5.8.8
Location: 
http://www.openspf.org/why.html?sender=gerber%40zenez.com&ip=83.149.198.201&receiver=is.intellij.net

It means that

  The requested resource has been assigned a new permanent URI and any
  future references to this resource SHOULD use one of the returned
  URIs.


Except for the obsolete pointer, the advice in the page thus referenced
seems valid ("This means SPF is working as designed"). Does that imply
that ispras.ru is _not_ working as it should? The text could be more
explicit on that point...


Finally, note that googling for `site:trusted-forwarders.org spf' yields
no results. That domain name has expired, so it is probably not a good
idea to include it in spf records, for the time being...




-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/735/=now
RSS Feed: https://www.listbox.com/member/archive/rss/735/
Powered by Listbox: http://www.listbox.com

<Prev in Thread] Current Thread [Next in Thread>