Mailing List Archive

[Bug 7909] New: SPF failure with correct SPF record
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7909

Bug ID: 7909
Summary: SPF failure with correct SPF record
Product: Spamassassin
Version: 3.4.2
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Plugins
Assignee: dev@spamassassin.apache.org
Reporter: sabug@lelik.org
Target Milestone: Undefined

The following mail is received from 40.107.15.83 which is included in SPF
record.

Spamassasing generates SPF fail for a bogus IPv6 address 2603:10a6:20b:284::13
.

Message below :

X-Original-To: REDACTED-for-SPAM@lelik.org
Delivered-To: REDACTED-for-SPAM@lelik.org
Received: from EUR01-DB5-obe.outbound.protection.outlook.com
(mail-eopbgr150083.outbound.protection.outlook.com [40.107.15.83])
by mail.lelik.us (Postfix) with ESMTPS id 4FhbBR47R9z3yZw
for <REDACTED-for-SPAM@lelik.org>; Fri, 14 May 2021 20:29:51 +0300
(MSK)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;

b=giZ0W13/Oh3OzrxCM6Irrxy09BZad/H7BUUwpakGOvjRRtYZ5T00jVyBrtYo4BCV4Qdf/JrC11g7RU6AwK6Bae44lNjkd0jSMzPnHxPAbskkCinOeL1CKt7Lm6DTYoNC/egGuBRRZaJ6zkpwnSg1JdJ3q84Mf8BsljzBOYa+F6lVE1H6EJaANEwLhssfoJPhVk8kGf7XKTnHf392dCBrvRT6iJX7taWKEgRCOcRutsVphX/7cvEiQ23VHlMhaKNMKgGD1y/X/7oT+OuL3xaUQzVxQ8fmb+DKZMtOp9yDbukl1YBQM6ZHSoqH6j82sGZE0+ZWn2TAHzpYDB4jOpJcww==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=6LQlzHNrx6UKswSAiPOnGSTMYw9T1sIIqksTXpDcJvA=;

b=RN3R/9bY5sDmWqDj+zVuohMrtRePjBZuSdbLsb0NqFIpeKzZEJfZcpErcw/4Hm2K5hsdu6qQdRPhgAAWW3gl7HeaCZBieVI9P2gUmkFXKjQ8OC/GMkbMS5T78vVygzkAx5h7TNqTElQHo0HvN+KH+KLH7tpkvW3sL20KXW4qGGb/LEnZ7wx3QndH2ll4WgZdczBXy6LcSpCbQJFlDyWDnyp3sdA+zDoeOvXtV5Kv2A/V1w4wP0q0wlu9HPYAjZ3J8EDEPDkPzEFp7DUIIGGcldGBoPbIoodexsdVKhKzstZdEONokFXSlC6ikisEFm4/2I7Ux21Kggnd61SDMceXAw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
smtp.mailfrom=hoermann.ru; dmarc=pass action=none header.from=hoermann.ru;
dkim=pass header.d=hoermann.ru; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hoermann.ru;
s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=6LQlzHNrx6UKswSAiPOnGSTMYw9T1sIIqksTXpDcJvA=;

b=KuUeJcb6IsFAXT1hDnoyFE1S/3WWboL87GQCWvHfmQaagLfByCWAKXtLyYf2igMJiWeg2a8Ck4lnQbPZ+qmQe+rhkMsrQU4fXFfx0IjDHtWJLuFeT/8TghGpVXfjxaVqMooS4MesNAQkko5egmRCy/lV7c9+CGWMsC+jJLlk04s8yIrwAs7w1DygG7/GFMtGcYVSCDswuw94Ob8+XiW3gNiZA4s9M+9/M4NsDmgbwNXC9Um0TjKE3bMdauQdmZOk8rf87U+tsOSdnp0HoC8PPEAlzq50xRLnyc46GtMMfVDuw6L5y32ahwBvpfNqzhmj558OfHBIscmslAtG9qLChA==
Received: from AM9PR03MB7028.eurprd03.prod.outlook.com (2603:10a6:20b:284::13)
by AM4PR0301MB2162.eurprd03.prod.outlook.com (2603:10a6:200:4c::12) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4129.26; Fri, 14 May
2021 17:29:44 +0000
Received: from AM9PR03MB7028.eurprd03.prod.outlook.com
([fe80::c98a:d824:3f7c:da91]) by AM9PR03MB7028.eurprd03.prod.outlook.com
([fe80::c98a:d824:3f7c:da91%3]) with mapi id 15.20.4129.028; Fri, 14 May 2021
17:29:44 +0000
From: [REDACTED]
To: [REDACTED],
Subject: [ SPAM ]
=?utf-8?B?0J7RgtCy0LXRgtC40YLRjDog0J3QtSDRgNCw0LHQvtGC0LDRjtGJ0LjQtSA=?=
=?utf-8?B?0LLQvtGA0L7RgtCwINC/0L7RgdC70LUg0YPRgdGC0LDQvdC+0LLQutC4?=
Thread-Topic:
=?utf-8?B?0J7RgtCy0LXRgtC40YLRjDog0J3QtSDRgNCw0LHQvtGC0LDRjtGJ0LjQtSA=?=
=?utf-8?B?0LLQvtGA0L7RgtCwINC/0L7RgdC70LUg0YPRgdGC0LDQvdC+0LLQutC4?=
Thread-Index: AQHXR9yLFLh4a2U+20WsJuw8610wJ6rjPRuI
Date: Fri, 14 May 2021 17:29:44 +0000
Message-ID:

<AM9PR03MB7028BD7964573A80E7766002A1509@AM9PR03MB7028.eurprd03.prod.outlook.com>
References: <fd91e185-357d-c896-2a77-ceafbc478821@lelik.org>
In-Reply-To: <fd91e185-357d-c896-2a77-ceafbc478821@lelik.org>
Accept-Language: ru-RU, en-US
Content-Language: ru-RU
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: lelik.org; dkim=none (message not signed)
header.d=none;lelik.org; dmarc=none action=none header.from=hoermann.ru;
x-originating-ip: [2a00:1fa0:2e1:d986:0:49:912e:4401]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 35f257ec-9d0e-4c0a-fb90-08d916fddd89
x-ms-traffictypediagnostic: AM4PR0301MB2162:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs:

<AM4PR0301MB216248C83A6EE0182C374746A1509@AM4PR0301MB2162.eurprd03.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:813;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:

e6E5Z9INOdrvcn1FxiqIlV5QhKJSoijjjkAkTt1lzW+8qSrsJ9Brw74Qmwze4VE0mNHcwECkj9LBzrysAxaqbWiGETKq00/KDqx+3eRbd5M6sal6W6Mvttquso6Eazb7CvgGESnhPcWloRvQHlhmEPFZ0Vgs+xn1LMWbgGkiDwcaIqqdwROnUFQ6BbxQjxpFtcUCJ8HuhPb7cO7l9elQt4nuIQctEG9iLEbTzcWK1+ddTCu4jmMRTxHSDsw3BCpUlvcCwDJxkZh6k8gpdwdOv4c9i9Ya5RzPI6XTDb2NSjI9f0359Mo0uBS8A4kQU07ZH5ExaPFcNiDKfwyH1kyPe66cxOwNw3lZC58N1EJ/U5+oIkUvMORwRN81zEP15XT3Vn7+OeV7BRc0c/yvubPCXEXy7zQI3HCjBLfOPCqR8JEHDTWds0bYRqXPlQoz9WJbqab4L8z6WoS+BEOyWw9eiNk95s9thirwClHqllyLLqMKe8fh1zN7+m+4pJUOIHF7HfkegB/sO1vkepxLHua6wa+JoMZ9ofElixOhKRROYMVloOsNYOO5ZU9gtqNmGtLHUoOWgRREs+FqTY88yruaQoXBLsxMYqypOEUb41ZrLRUT2dmVdOnQjKjFh8XVcANrzMxtVpPC+oYHo3C2g69FMbxqxhCbTHu2fsoFoThilYjeK7zrEERu1EFjAY2kXtk5
x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:ru;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM9PR03MB7028.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(366004)(346002)(136003)(39840400004)(376002)(396003)(5660300002)(38100700002)(8936002)(186003)(110136005)(76116006)(316002)(52536014)(478600001)(7696005)(966005)(224303003)(66446008)(64756008)(66556008)(66476007)(86362001)(33656002)(166002)(66946007)(6506007)(9686003)(2906002)(71200400001)(55016002)(122000001)(6636002);DIR:OUT;SFP:1101;
Content-Type: multipart/alternative;

boundary="_000_AM9PR03MB7028BD7964573A80E7766002A1509AM9PR03MB7028eurp_"
MIME-Version: 1.0
X-OriginatorOrg: hoermann.ru
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: AM9PR03MB7028.eurprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id:
35f257ec-9d0e-4c0a-fb90-08d916fddd89
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 May 2021 17:29:44.7954
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: ceacd533-92bb-4019-8a8f-2411887c49c7
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname:
jN9ZqPZwZWE5fUcFqrVpppDvk9wg6TROL2UrSTHgWkS292QUq7ueH9xswQWwawT3sQTsJvwFYYW0xgQGgFMY1Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0301MB2162
X-Spam-Flag: YES
X-Spam-Status: Yes, score=7.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
DKIM_VALID_AU,DKIM_VALID_EF,HTML_MESSAGE,MIXED_ES,SPF_FAIL,
SPF_HELO_NONE,UNPARSEABLE_RELAY autolearn=no autolearn_force=no
version=3.4.2
X-Spam-Report:
* 5.0 SPF_FAIL SPF: sender does not match SPF record (fail)
* [SPF failed: Please see
http://www.openspf.org/Why?s=mfrom;id=[REDACTED];ip=2603%3A10a6%3A20b%3A284%3A%3A13;r=mail.lelik.us]
* 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
* 0.0 HTML_MESSAGE BODY: HTML included in message
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
* envelope-from domain
* -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
* author's domain
* 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay
* lines
* 3.0 MIXED_ES Too many es are not es
X-Spam-Level: *******
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mail.lelik.us

--
You are receiving this mail because:
You are the assignee for the bug.