Mailing List Archive

Blacklist all and just whitelist email addresses you want to receive
from.



-----Original Message-----
From: Pedro David Marco [mailto:pedrod_marco@yahoo.com]
Sent: donderdag 16 juli 2020 9:18
To: Users
Subject: Detecting SendGrid shared IPs

Is there any way to know whether a Sendgrid IP is shared or dedicated?

Thanks in advance!


--------
Pedro

Why?

----------------
From: Pedro David Marco <pedrod_marco@yahoo.com>
Date: Thu, Jul 16, 2020 at 09:18 AM
Subject: Detecting SendGrid shared IPs
To: Users <users@spamassassin.apache.org>

>
Is there any way to know whether a Sendgrid IP is shared or dedicated?

Thanks in advance!


--------
Pedro

Bumping a little the score for shared IPs? Could make sense..

On 16/07/20 14:10, me@junc.eu wrote:
> Why?
>
> ----------------
> From: Pedro David Marco <pedrod_marco@yahoo.com>
> Date: Thu, Jul 16, 2020 at 09:18 AM
> Subject: Detecting SendGrid shared IPs
> To: Users <users@spamassassin.apache.org>
>
> Is there any way to know whether a Sendgrid IP is shared or dedicated?
>
> Thanks in advance!
>
>
> --------
> Pedro

--
Best regards,
Riccardo Alfieri

Spamhaus Technology
https://www.spamhaustech.com/

>On Thursday, July 16, 2020, 03:26:08 PM GMT+2, Riccardo Alfieri <riccardo.alfieri@spamteq.com> wrote:
>Bumping a little the score for shared IPs? Could make sense..

Exactly...


-----Pedro

Pedro David Marco wrote:
> Is there any way to know whether a Sendgrid IP is shared or dedicated?

Use the FCrDNS data and one or another of the X-Spam-Relays metaheaders.
It should be possible to quickly refine these to "good enough", if
they're not already (watch for word wrap):

header SENDGRID_SHARED_1 X-Spam-Relays-Untrusted =~ /^\[[^\]]+
rdns=[\w\d.]+\.shared\.sendgrid\.net /

header SENDGRID_SHARED_2 X-Spam-Relays-Untrusted =~ /^\[[^\]]+
rdns=[\w\d.]+.outbound-mail.sendgrid.net /

I suspect the second matches a somewhat different slice of their
services than you're asking about, but I can't say I can really tell the
difference from the outside.

-kgd

On Thu, 16 Jul 2020 11:07:46 -0400
Kris Deugau wrote:

> Pedro David Marco wrote:
> > Is there any way to know whether a Sendgrid IP is shared or
> > dedicated?
>
> Use the FCrDNS data and one or another of the X-Spam-Relays
> metaheaders. It should be possible to quickly refine these to "good
> enough", if they're not already (watch for word wrap):
>
> header SENDGRID_SHARED_1 X-Spam-Relays-Untrusted =~ /^\[[^\]]+
> rdns=[\w\d.]+\.shared\.sendgrid\.net /
>
> header SENDGRID_SHARED_2 X-Spam-Relays-Untrusted =~ /^\[[^\]]+
> rdns=[\w\d.]+.outbound-mail.sendgrid.net /
>
> I suspect the second matches a somewhat different slice of their
> services than you're asking about, but I can't say I can really tell
> the difference from the outside.


What I'm seeing is that in most sendgrid emails the last-external
rDNS has the customer's own domain e.g.

X-Spam-Relays-External: [ ip=208.117.49.194 rdns=o10.em.spotify.com

The IP address there belongs to sendgrid.

sendgrid.net doesn't then show in the X-Spam-Relays-* headers because
it's in a header like this:

Received: by filter2092p1mdw1.sendgrid.net with SMTP ...

a format that SA deliberately skips when parsing received headers.

The obvious interpretation that "shared" is shared and "outbound-mail"
is sendgrid's own email doesn't seen to be correct. I have both
forms in third-party email.

Also I'm seeing that senders with their own dedicated IP addresses
sometimes use shared addresses too.

Although it looks easy to distinguish between shared and dedicated
addresses it doesn't seem like a useful indicator to me.

Looks like I might have replied to Kris and not the maillist. Sorry if
this shows up twice.

Made a couple adjustments to the two patterns and merged them into one if
anyone is interested.

/^\[[^\]]+
(?:helo|rdns)=[\w\d.]+\.(?:outbound-e?mail|shared)\.sendgrid\.net /


On Thu, Jul 16, 2020 at 11:07 AM Kris Deugau <kdeugau@vianet.ca> wrote:

> Pedro David Marco wrote:
> > Is there any way to know whether a Sendgrid IP is shared or dedicated?
>
> Use the FCrDNS data and one or another of the X-Spam-Relays metaheaders.
> It should be possible to quickly refine these to "good enough", if
> they're not already (watch for word wrap):
>
> header SENDGRID_SHARED_1 X-Spam-Relays-Untrusted =~ /^\[[^\]]+
> rdns=[\w\d.]+\.shared\.sendgrid\.net /
>
> header SENDGRID_SHARED_2 X-Spam-Relays-Untrusted =~ /^\[[^\]]+
> rdns=[\w\d.]+.outbound-mail.sendgrid.net /
>
> I suspect the second matches a somewhat different slice of their
> services than you're asking about, but I can't say I can really tell the
> difference from the outside.
>
> -kgd
>