gmane.mail.spam.spf.help

Thank you for being part of spf-help

spf-help — 2011-04-20T13:44:48


We've removed gmssh-spf-help-2< at >m.gmane.org from spf-help.

No further action is necessary. Thank you for being with us.

-----------------------------------------------------------

**** PLEASE NOTE ****

We are getting reports of INVOLUNTARY UNSUBSCRIBTIONS.
We believe that there is a bug in the list software so
that people may be unsubscribed without asking to be
unsubscribed. The message may say that you were dropped
by the list moderator, but that part of the message is
false. If this happened to you, please resubscribe.

Rejoin spf-help [https://www.listbox.com/member/?member_id=10912636&id_secret=10912636-0616e5eb] at https://www.listbox.com/member/?member_id=10912636&id_secret=10912636-0616e5eb

RE: [unsure] multiple domains

Chris Mathis — 2011-03-09T10:55:32

If it helps, I have a similar setup. One server, but I have multiple IP
addresses. On my primary domain and IP, the txt record is this, (not real IP
or domain here of course) The "primarydomain.com" has this as it's txt
record:

v=spf1 ip4:93.64.27.283 ip4: 93.64.27.284 ip4: 93.64.27.285 ip4:
93.64.27.286 -all

All the other domains on my server have this is their txt record:

v=spf1 redirect=primarydomain.com


Is this still correct? If so, hope this helps.

Chris...


-----Original Message-----
From: brian [mailto:brian< at >zijn-digital.com] 
Sent: Tuesday, March 08, 2011 5:36 PM
To: spf-help< at >listbox.com
Subject: Re: [unsure] [spf-help] multiple domains

On 11-03-08 04:52 PM, Alex van den Bogaerdt wrote:
domain2.example

understood


So you're saying that each domain needs a TXT record?

domain1.com. IN TXT "v=spf1 ip4:p.q.r.s -all"
domain2.com. IN TXT "v=spf1 ip4:p.q.r.s -all"
...


Thanks for the tip.


I think this is where I became confused because I was unsure how to 
relate domain2.com to mail.domain1.co

Re: [unsure] multiple domains

Alex van den Bogaerdt — 2011-03-09T03:44:24

Yeah. Pretend to be the receiving mail server, and ask yourself what you 
want to know.
You already know "p.q.r.s" is trying to do something.
Next question you have, when you see "mail from: 
<someuser< at >exampledomain.example>" is: do the people at exampledomain.example 
want to have p.q.r.s speak on their behalf.  So you need to look at 
exampledomain.example

Repeat for every name.




You don't.


Provided that you presented your case correctly: yes.


That's the right attitude :)

Re: [unsure] multiple domains

Andrew Culver — 2011-03-09T00:40:46

Yes. Specifically, you should create an SPF/TXT record for:

1) each domain that is used to send mail. eg, if you send as 
user< at >domain1.com, then domain1.com should have an SPF record. If you 
send mail as user< at >lists.domain1.com, then lists.domain1.com will also 
need its own SPF record.

2) each domain that you want to prevent others from forging addresses 
under. eg, you may not send mail as www.domain1.com, but if you add an 
SPF record for it (v=spf1 -all), you will make it harder for people to 
forge sender addresses as user< at >www.domain1.com.

Subdomains are all separate names and each need their own SPF record. 
SPF doesn't inherit to subdomains.

Andrew

Re: [unsure] multiple domains

brian — 2011-03-08T22:35:43

understood


So you're saying that each domain needs a TXT record?

domain1.com. IN TXT "v=spf1 ip4:p.q.r.s -all"
domain2.com. IN TXT "v=spf1 ip4:p.q.r.s -all"
...


Thanks for the tip.


I think this is where I became confused because I was unsure how to 
relate domain2.com to mail.domain1.com. So, if I create one for each 
domain and use ip4 for all of them, that should suffice?


No, I don't expect the IP to change. If it does for some reason, 
changing the TXT records is easy enough.

thanks

Re: [unsure] multiple domains

Alex van den Bogaerdt — 2011-03-08T21:52:24

----- Original Message ----- 
From: "brian" <brian< at >zijn-digital.com>
To: <spf-help< at >listbox.com>
Sent: Tuesday, March 08, 2011 9:58 PM
Subject: [unsure] [spf-help] multiple domains

Step 1:
Your server contacts another server. That other server knows the IP address 
p.q.r.s.

Next step:
Your server says "HELO mail.domain1.example"
The other server looks in DNS for the SPF policy for mail.domain1.example
The SPF policy is looked at. Does it authorize IP address p.q.r.s or not?

Next step:
Your server says "MAIL FROM: <user< at >domain2.com>"
The other server looks in DNS for the SPF policy for domain domain2.example
The SPF policy is looked at. Does it authorize IP address p.q.r.s or not?

Every DNS domain name used (mail.domain1.example, domain2.example, 
subdomain.of.domain3.example, and so on) needs an SPF policy. That policy 
needs to authorize only one IP address (in your case, if you correctly 
presented your setup).

So:  "v=spf1 ip4:p.q.r.s -all" (and of course you fill in p.q.r.s) for each 
name used.

multiple domains

brian — 2011-03-08T20:58:37

I have several domains hosted on a single server. That machine's 
hostname is domain1.com, same as that used for Postfix. The outgoing 
server used for all email accounts is mail.domain1.com.

I'm having a lot of trouble understanding how to create SPF records for 
all of the domains on this server. Specifically, the instructions for 
the tool at openspf.org are making my head spin. I think that this is 
what I need:

domain1.com:
v=spf1 a:mail.domain1.com -all

domain2.com:
v=spf1 a:domain2.com include:mail.domain1.com -all

etc.

Is this correct? I'm unsure whether I need an SPF record for each 
domain, or a single one for domain1.com that includes the others.

Re: minor SIDF/SPF clarification

2011-03-07T20:55:51

Sorry, last post, I swear:


...it fails that mechanism only, not necessarily the entire evaluation, of course... -c

Re: minor SIDF/SPF clarification

2011-03-07T20:50:15

Er, make that RFC 4408... -c

Re: minor SIDF/SPF clarification

2011-03-07T20:20:40

Alan - Thanks for the clarifications.


Thanks, I knew this would be a bad mark on an email even without SPF, but somehow I had it in my head that SPF required it explicitly. I will 
amend my page.

Digging around in RFC 2208, I did find that the "ptr" token does require FCRDNS with the further requirement I described, as you guessed.

Also interesting to learn (given the subject of my how-to) was that while most DNS timeout errors are supposed to give TempError, when 
evaluating a "ptr" token a DNS error looking up a PTR RR record yields a "fail", while errors that happen when looking up the related A records 
for the discovered PTR domains is supposed to just not include those domains as possibly matching for the sake of evaluating the "ptr" match.

Thanks again,
-Casey

Re: minor SIDF/SPF clarification

alan — 2011-03-07T09:08:38


I think in this you are getting outside the bounds of SPF, the PTR: spf method may require this, but no-one sane uses the PTR: method
the requirement for IP > name > ip is more basic than SPF and usually checked by any mailserver long before even looking for/at the spf record
its a requirement for being a client host for most Internet services, and pre dates the invention of SPF.
its also a simple/cheap test that allows most mailservers to know the IP address is illegitimate and just reject the mail without wasting energy even looking at the spf records or anything else.

the requirement is referred to as FCRDNS and is a requirement of SMTP 



no spf dosn't, but all the rest of DNS does, so yes if your DNS is broken/malfunctioning spf maybe irrelevant


feel free to look at my own crappy howto for smtp
http://www.alandoherty.net/info/mailservers/

Re: minor SIDF/SPF clarification

2011-03-05T03:13:35

Hello -

In the past, the company I work for had issues with detecting SPF failures for incoming messages that end up actually being DNS problems that 
were getting filtered through verification code and interpreted (incorrectly or not, depending on the perspective) as "failures".

I recently made a tutorial page about basic SPF record investigation, especially focused on confirming that the nameservers for the domain in 
question are functioning. I'm neither a DNS expert nor an SPF expert, so I wanted to throw the link up here to see if any one had any feedback 
or corrections I make. I certainly don't want to be putting misinformation out there (enough of that already with SPF/DKIM/etc):

http://lacinato.com/cm/blog/76-spfdnstroubleshooting

Particularly these two parts:

"SPF passes also require a valid PTR record for the IP: take the IP of the sending mail server and do a reverse lookup. It will return one or 
more host names. One of those host names must resolve back to the IP."

...I think I've left ou

Re: Help with SPF for multiple domains please

Andrew Culver — 2011-03-04T21:28:32

Hi Jackie,

You're almost there.

You're correct with the includes for google and cmail1, since you're 
following their instructions to include what they tell you to.

For rezserve.com, you need to ask them if they provide (or can provide) 
an SPF record for you to include. If not, you'll need to ask them what 
servers they send mail from which you would need to add to your SPF 
record. The problem with this is, if they change their servers, you must 
change your SPF record.

No, the "a" and "mx" mechanics are not needed. The "a" refers to 
69.90.160.124, which you didn't mention as a host that would be sending 
mail and "mx" refers to google's MX servers, which you don't need to list.

Your end SPF record will probably end up looking like:

"v=spf1 include:_spf.rezserv.com include:cmail1.com 
include:_spf.google.com ~all"
(assuming that rezserv is able to create an SPF record for their domain 
under _spf.rezserv.com which you can then include)

Or:

"v=spf1 ip4:1.2.3.4 include:cmail1.com include:_spf.google

Help with SPF for multiple domains please

Jackie Choquette — 2011-03-04T21:12:01

I am trying to help a client of my set up an SPF record for his domain. He has 
the need to authenticate mail from three locations

1. his domain whistlerreservations.com which is set up with google apps mail

2. Via a third party booking engine that sends mail from the domain rezserve.com

3. Via campaign monitor (cmail1.com) which is an email distribution system.

I have set up the following

v=spf1 a mx include:rezserve.com include:cmail1.com include:_spf.google.com ~all

but am getting the following error when validating with the 
http://www.kitterman.com/spf/validate.html SPF Records Testing Tools Results - 

PermError SPF Permanent Error: No valid SPF record for included domain: 
rezserve.com: include:rezserve.com 

Does Rezserve.com have to do something on there end? If so what do they need to 
do? Also do I need to specify a mx in my spf if I already have 
include:_spf.google.com in there? 

I hacked this together from various sources

1) google apps help - google.com/support/a/bin/answer.py?answer=1

Re: do you see something i don't [fixed]

Carlos R. Pasqualini — 2011-03-04T19:38:33

thanks!
It was a routing error on the other side

thanks!

Re: do you see something i don't

Carlos R. Pasqualini — 2011-03-02T20:22:34

El mi�, 02-03-2011 a las 15:11 -0500, Andrew Culver escribi�:

i am not the receiver MTA's administrator, i am trying to contact him to
get some feedback.

as i can see on the reply i have posted to this list (see my first
email), they are locating our server using the RIU network (170.210.x.x)
so it is supposed they see the right side of my Bind


regards

Re: do you see something i don't

Andrew Culver — 2011-03-02T20:11:42


But is that what the receiving MTA sees when it looks up the records? 
Try running this on the receiving MTA:

$ getent hosts listas.fcal.uner.edu.ar
190.228.25.197  listas.fcal.uner.edu.ar

Re: do you see something i don't

Carlos R. Pasqualini — 2011-03-02T20:04:14

El mi�, 02-03-2011 a las 14:59 -0500, Andrew Culver escribi�:

that's because you are not inside the RIU network, that is our
commercial link and the visible address to commercial Internet

it isn't an error, it's the supposed answer



regards.

Re: Where is the difference?

Andrew Culver — 2011-02-25T18:40:27

Better still, list ALL servers that should legitimately be sending mail 
for this domain, then account for them in your SPF record.

Andrew


Benny Pedersen wrote, On 11-02-25 01:30 PM:

Re: Where is the difference?

Benny Pedersen — 2011-02-25T18:30:06


http://old.openspf.org/wizard.html?mydomain=aerobicyfitness.espainucli.com&submit=Go!

aerobicyfitness.espainucli.com's IP address is 212.36.77.75
(xen-ad0059.srv.cat). 
Does that server send mail from aerobicyfitness.espainucli.com?

add ip4:212.36.77.75 to the above spf record

Re: Contact information to the webmaster for openspf.org

Jason Lewis — 2011-02-18T20:00:18

Just in testing, I get the same error no matter what I put in for the topic,
confidentiality, email, or message.  The page and form was last changed by
Julian back in 2006.  The issue could be the sendmail software or
configuration on the server.  Is this a topic can can be discussed in an
open email list, or has any form of confidentiality with it?

On Thu, Feb 17, 2011 at 8:07 AM, Anders Boholdt-Petersen <
english_correspondences< at >boholdt-petersen.dk> wrote:




-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/10912636-69271972
Modify Your Subscription: https://www.listbox.com/member/?member_id=10912636&id_secret=10912636-0616e5eb
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=10912636&id_secret=10912636-4d44967a&post_i