Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. SPF>
  3. Deployment
spfmilter sometimes rejects sometimes accepts from same host
gdsm at tgfslp
Nov 27, 2005, 6:48 AM
Post #1 of 12 (26217 views)
Permalink
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

My spfmilter is sometimes rejecting mail from a mailing list, but on other
occasions, is accepting mail from the same mailing list. Would anybody be
able to tell me why please? and how do I fix it?

550 5.7.1 <weather-bounces+user=tgfslp.dalmany.co.uk@buoy.com>...
rejected by spfmilter

log extract:
Nov 24 09:57:13 spitfire sm-mta[3580]: NOQUEUE: connect from mail@buoy.com
[216.204.160.109]
Nov 24 09:57:14 spitfire sm-mta[3580]: AUTH: available mech=DIGEST-MD5
CRAM-MD5, allowed mech=CRAM-MD5 DIGEST-MD5
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (dcc): init
success to negotiate
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (spfmilter):
init success to negotiate
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (clamav):
init success to negotiate
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: Milter: connect to
filters
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: milter=dcc,
action=connect, continue
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: milter=spfmilter,
action=connect, continue
Nov 24 09:57:14 spitfire sm-mta[3580]: jAO9vDgw003580: milter=clamav,
action=connect, continue
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 220
mail.dalmany.co.uk ESMTP Sendmail 8.13.5/8.13.5/Debian-3; Thu, 24 Nov 2005
09:57:14 GMT; (No UCE/UBE) logging access from: buoy.com(OK)-mail@buoy.com
[216.204.160.109]
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: <-- EHLO
users.buoy.com
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: milter=spfmilter,
action=helo, continue
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: ---
250-mail.dalmany.co.uk Hello mail@buoy.com [216.204.160.109], pleased to
meet you
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: ---
250-ENHANCEDSTATUSCODES
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-PIPELINING
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-8BITMIME
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-SIZE
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-DSN
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-ETRN
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-AUTH
CRAM-MD5 DIGEST-MD5
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-STARTTLS
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250-DELIVERBY
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: --- 250 HELP
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: <-- MAIL
FROM:<weather-bounces+gdsm=tgfslp.dalmany.co.uk@buoy.com> SIZE=5170
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: Milter: senders:
<weather-bounces+gdsm=tgfslp.dalmany.co.uk@buoy.com>
Nov 24 09:57:19 spitfire sm-mta[3580]: jAO9vDgw003580: milter=dcc,
action=mail, continue
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: milter=spfmilter,
action=mail, reject=550 5.7.1 rejected by spfmilter
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (dcc): abort
filter
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: Milter:
from=<weather-bounces+gdsm=tgfslp.dalmany.co.uk@buoy.com>, reject=550
5.7.1 rejected by spfmilter
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: --- 550 5.7.1
<weather-bounces+gdsm=tgfslp.dalmany.co.uk@buoy.com>... rejected by
spfmilter
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: <-- RCPT
TO:<gdsm@tgfslp.dalmany.co.uk>
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: --- 503 5.0.0 Need
MAIL before RCPT
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: <-- DATA
Nov 24 09:57:20 spitfire sm-mta[3580]: jAO9vDgw003580: --- 503 5.0.0 Need
MAIL command
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: <-- QUIT
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: --- 221 2.0.0
mail.dalmany.co.uk closing connection
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (dcc): quit
filter
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (spfmilter):
quit filter
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580: Milter (clamav):
quit filter
Nov 24 09:57:21 spitfire sm-mta[3580]: jAO9vDgw003580:
from=<weather-bounces+gdsm=tgfslp.dalmany.co.uk@buoy.com>, size=5170,
class=0, nrcpts=0, proto=ESMTP, daemon=MTA-v4, relay=mail@buoy.com
[216.204.160.109]

I am using spfmilter 0.97, libspf 1.0, sendmail 8.13.5, linux 2.6.14. How
do I permit this to pass?

Many thanks,

Spencer

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDicciI1ja71kPXjARAjcgAKCGV7+7YOfWTDqI8XJebeQAZzN3YwCeNZ91
Qw73eDKQ5xkKQWtYlDmWsVw=
=SRLt
-----END PGP SIGNATURE-----

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
RE: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
Matthew.van.Eerde at hbinc
Nov 28, 2005, 10:25 AM
Post #2 of 12 (25466 views)
Permalink
G.D.S.Marshall wrote:
> My spfmilter is sometimes rejecting mail from a mailing list, but on
> other occasions, is accepting mail from the same mailing list. Would
> anybody be
> able to tell me why please? and how do I fix it?
>
> 550 5.7.1 <weather-bounces+user=tgfslp.dalmany.co.uk@buoy.com>...
> rejected by spfmilter

buoy.com has two SPF records:

v=spf1 ptr -all
v=spf1 mx -all

I would gather that one of these is correct, and one is wrong.

When spfmilter does the lookup, one of the SPF records is chosen at random.

When the correct one is chosen, the mail goes through.

When the wrong one is chosen, the mail is rejected.

spfmilter is CORRECT here. buoy.com is misconfigured.

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
Re: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
mark at primefactor
Nov 28, 2005, 11:58 AM
Post #3 of 12 (25500 views)
Permalink
On Mon, Nov 28, 2005 at 10:25:22AM -0800, Matthew.van.Eerde@hbinc.com wrote:
>
> buoy.com has two SPF records:
>
> v=spf1 ptr -all
> v=spf1 mx -all

Both of those records are pretty unusual:

$ host -t txt buoy.com
buoy.com text "\\\"v=spf1 mx -all\\\""
buoy.com text "\\\"v=spf1 ptr -all\\\""

Since neither record begins with "v=spf1 ", wouldn't that mean that
neither record qualifies as being an SPF record? (Meaning that the
expected result should be NONE.)

--
Mark Shewmaker
mark@primefactor.com

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
RE: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
Matthew.van.Eerde at hbinc
Nov 28, 2005, 1:38 PM
Post #4 of 12 (25471 views)
Permalink
Mark Shewmaker wrote:
> $ host -t txt buoy.com
> buoy.com text "\\\"v=spf1 mx -all\\\""
> buoy.com text "\\\"v=spf1 ptr -all\\\""

Huh?

$ host -t txt buoy.com
buoy.com text "v=spf1 mx -all"
buoy.com text "v=spf1 ptr -all"

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
RE: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
robert.barclay at returnpath
Nov 28, 2005, 1:40 PM
Post #5 of 12 (25478 views)
Permalink
This domain appears to have two nameservers that don't exactly match. In
my experience this seems to be the most common cause of inconsistent
results for a host.

; <<>> DiG 9.2.4 <<>> buoy.com txt @unslept.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15361
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;buoy.com. IN TXT

;; ANSWER SECTION:
buoy.com. 3600 IN TXT "\\\"v=spf1 ptr
-all\\\""
buoy.com. 3600 IN TXT "\\\"v=spf1 mx -all\\\""


; <<>> DiG 9.2.4 <<>> buoy.com txt @users.buoy.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28671
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;buoy.com. IN TXT

;; ANSWER SECTION:
buoy.com. 3600 IN TXT "v=spf1 mx -all"
buoy.com. 3600 IN TXT "v=spf1 ptr -all"

-----Original Message-----
From: Matthew.van.Eerde@hbinc.com [mailto:Matthew.van.Eerde@hbinc.com]
Sent: Monday, November 28, 2005 2:38 PM
To: spf-deployment@v2.listbox.com
Subject: RE: [spf-deployment] spfmilter sometimes rejects sometimes
accepts from same host

Mark Shewmaker wrote:
> $ host -t txt buoy.com
> buoy.com text "\\\"v=spf1 mx -all\\\""
> buoy.com text "\\\"v=spf1 ptr -all\\\""

Huh?

$ host -t txt buoy.com
buoy.com text "v=spf1 mx -all"
buoy.com text "v=spf1 ptr -all"

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
RE: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
Matthew.van.Eerde at hbinc
Nov 28, 2005, 2:01 PM
Post #6 of 12 (25503 views)
Permalink
Robert Barclay wrote:
> This domain appears to have two nameservers that don't exactly match.
> In my experience this seems to be the most common cause of
> inconsistent results for a host.

Wow...

OK, so buoy.com has two domain name servers AND two TXT records.

It looks like the replication between them is broken... so one has two text records of

v=spf1 ...
v=spf1 ...

and the other has text records of
\"v=spf1 ...
\"v=spf1 ...

where both the backslash and the quote are literal.

The good news is that the mail server in question satisfies both the PTR and the MX requirements. So you should get either PASS or NONE, right? I still don't understand how FAIL could come up.

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
RE: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
gdsm at tgfslp
Nov 28, 2005, 2:10 PM
Post #7 of 12 (25478 views)
Permalink
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> G.D.S.Marshall wrote:
>> My spfmilter is sometimes rejecting mail from a mailing list, but on
>> other occasions, is accepting mail from the same mailing list. Would
>> anybody be
>> able to tell me why please? and how do I fix it?
>>
>> 550 5.7.1 <weather-bounces+user=tgfslp.dalmany.co.uk@buoy.com>...
>> rejected by spfmilter
>
> buoy.com has two SPF records:
>
> v=spf1 ptr -all
> v=spf1 mx -all
>
> I would gather that one of these is correct, and one is wrong.
>
> When spfmilter does the lookup, one of the SPF records is chosen at
> random.
>
> When the correct one is chosen, the mail goes through.
>
> When the wrong one is chosen, the mail is rejected.
>
> spfmilter is CORRECT here. buoy.com is misconfigured.

Understood, I would have expected it to be on one line! I tried to get
spfmilter to log, however, --debug=99 and --nodaemon do not seem to add
much if anything to the logging. How do I get spfmilter to debug logs,
even if I use --debug=1, it does not work.

Many thanks,

Spencer



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD4DBQFDi4BTI1ja71kPXjARAvE+AJicaDlMupH6EivbH4Zs7NMEREXZAJ9YHlmc
ZkFVmfMysJl5h5VbpYv92A==
=0lVf
-----END PGP SIGNATURE-----

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
RE: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
Matthew.van.Eerde at hbinc
Nov 28, 2005, 2:21 PM
Post #8 of 12 (25472 views)
Permalink
Matthew.van.Eerde wrote:
> The good news is that the mail server in question satisfies both the
> PTR and the MX requirements. So you should get either PASS or NONE,
> right? I still don't understand how FAIL could come up.

Unless it's because of libspf not implementing the MX check. That would reduce one of the records to -all.

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
Re: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
mark at primefactor
Nov 28, 2005, 2:46 PM
Post #9 of 12 (25480 views)
Permalink
On Mon, Nov 28, 2005 at 02:01:48PM -0800, Matthew.van.Eerde@hbinc.com wrote:

[.good summary of two sets of two records from two nameservers deleted]

> The good news is that the mail server in question satisfies both the
> PTR and the MX requirements. So you should get either PASS or NONE,
> right? I still don't understand how FAIL could come up.

This is a bit convoluted, but:

1. If the spf query were returning just one record instead of two,
(or if spfmilter were ignoring one of the two records),

AND

2. if that one record used/seen as starting with the right token,
that is with no quotes or backslashes, (or if spfmilter were
ignoring those beginning backslashes and quotes),

AND

3. if spfmmilter *didn't* ignore the quote and backslash in the trailing
-all\"

Then maybe spfmilter could be rejecting on a PERMERROR, since:

-all

would be a recognized mechanism, but

-all\"

is an unrecognized mechanism.

Could something like that be going on? (Or rather, is there a path
through that convoluted mess that might correspond in some way with
reality?)

--
Mark Shewmaker
mark@primefactor.com

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
Re: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
lennon at orcon
Nov 28, 2005, 3:37 PM
Post #10 of 12 (25484 views)
Permalink
> The good news is that the mail server in question satisfies both the PTR
> and the MX requirements. So you should get either > PASS or NONE, right?
> I still don't understand how FAIL could come up.

bouy.com SHOULD give NONE as the SPF record starts with \\\ and it is not a
valid SPF record

Thanks
Craig




-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
RE: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
Matthew.van.Eerde at hbinc
Nov 28, 2005, 4:37 PM
Post #11 of 12 (25483 views)
Permalink
Craig Whitmore wrote:
>> The good news is that the mail server in question satisfies both the
>> PTR and the MX requirements. So you should get either > PASS or
>> NONE, right? I still don't understand how FAIL could come up.
>
> bouy.com SHOULD give NONE as the SPF record starts with \\\ and it is
> not a valid SPF record

Well, it does, and it doesn't...

Two name servers:
$ host -t ns buoy.com
buoy.com name server buoy.com.
buoy.com name server unslept.com.

The first name server has two SPF records which are both fine:
$ host -t txt buoy.com buoy.com
Using domain server:
Name: buoy.com
Address: 216.204.160.109#53
Aliases:

buoy.com text "v=spf1 mx -all"
buoy.com text "v=spf1 ptr -all"

This should PASS.

The second name server has two malformed records:
$ host -t txt buoy.com unslept.com
Using domain server:
Name: unslept.com
Address: 168.100.186.146#53
Aliases:

buoy.com text "\\\"v=spf1 ptr -all\\\""
buoy.com text "\\\"v=spf1 mx -all\\\""

This should NONE.

--
Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com
Re: spfmilter sometimes rejects sometimes accepts from same host [ In reply to ]
spf2 at kitterman
Nov 28, 2005, 4:48 PM
Post #12 of 12 (25481 views)
Permalink
I'd like to suggest that this thread is better suited to spf-discuss or
spf-help and perhaps it ought to be followed up one of those places....

Scott K

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-deployment@v2.listbox.com

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal