Mailing List Archive: SPF Config

SPF Config - Newbie

Jun 15, 2004, 7:55 AM

Post #1 of 7 (4797 views)

Hi,

I run a small company network. We get all our email from our isp.
clara.net via ordinary dialup.

I have installed all packages as described and have the spf-milter
running with sendmail.. I can see that it is adding the following header
to recieved emails:-

Received-SPF: pass (our.F.Q.D.N: localhost is always allowed.)

outgoing emails have this:-

Received-SPF: none (our.F.Q.D.N: domain of user@ourdomain.com does not
designate permitted sender hosts)

Question: Do i need to publish SPF records and if so do i get the ip
from clara.net's mail servers (i've noticed that the online wizard 'auto
fills' with clara.net details.)

Question: I would like to reject all forged emails and set up my domain
for outgoing email, what configs do I need to make and options do I run
with the sendmail-milter.pl

at present I can send and recieve email but no email is being rejected
or tagged with anything but 'pass'

Regards

Nigel Kilner
===========================
Kilner Vacuumation Co Ltd.
UK
============================

________________________________________________________________

Kilner Vacuumation Co. Ltd. http://www.kilner-vacuum-lifting.com
Tel. +44 1246 416441 Fax. +44 1246 290573
________________________________________________________________

Scanned for viruses by F-Prot Antivirus - http://www.f-prot.com

All information contained in this email is confidential and may
be used by the intended recipient only.

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

RE: SPF Config - Newbie [ In reply to ]

spf at kitterman

Jun 15, 2004, 8:20 AM

Post #2 of 7 (4736 views)

Permalink

> -----Original Message-----
> From: owner-spf-help@v2.listbox.com
> [mailto:owner-spf-help@v2.listbox.com]On Behalf Of Nigel
> Sent: Tuesday, June 15, 2004 10:55 AM
> To: spf-help@v2.listbox.com
> Subject: [spf-help] SPF Config - Newbie
>
>
> Hi,
>
> I run a small company network. We get all our email from our isp.
> clara.net via ordinary dialup.
>
snip
> Question: Do i need to publish SPF records and if so do i get the ip
> from clara.net's mail servers (i've noticed that the online wizard 'auto
> fills' with clara.net details.)

Sorry I can't be of more help, but here's what I think I can tell you
reliably:

Clara.net does not publish an SPF record (you should ask them to). If they
did, then you could use the include mechanism to say that any sender
permitted by clara.net is permitted by you. Instead, you need to find out
the name(s) of the servers that clara.net uses to send out mail. They may
be the mx, but often aren't. The best way to do this that I've found is to
send yourself several e-mails and inspect the headers. Here are some
relevant posts from the archives:

http://archives.listbox.com/spf-help@v2.listbox.com/200406/0036.html

http://archives.listbox.com/spf-help@v2.listbox.com/200406/0038.html

Scott

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: SPF Config - Newbie [ In reply to ]

nobody at xyzzy

Jun 15, 2004, 9:11 AM

Post #3 of 7 (4671 views)

Permalink

Nigel wrote:

> Question: Do i need to publish SPF records

Only if you _want_ to publish a sender policy for
nkilner.fsnet.co.uk (and if that's the domain in
question... ;-)

See Scott's answer, one way to find your relevant
smart hosts is to send a mail to somebody else
via your smart host, and then check the Received:
headers for clara.net's mailout.

This could be relay.clara.net, and then you could
use "v=spf1 a:relay.clara.net ?all" for tests.

For some obscure reasons "a:relay.claranet.co.uk"
is a proper subset of "a:relay.clara.net" at the
moment, so maybe a more reliable solution for you
would be to add "ip4:80.168.70.141/24" before both
relays.
Bye, Frank

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: SPF Config - Newbie [ In reply to ]

nigel at nkilner

Jun 15, 2004, 1:27 PM

Post #4 of 7 (4670 views)

Permalink

> See Scott's answer, one way to find your relevant
> smart hosts is to send a mail to somebody else
> via your smart host, and then check the Received:
> headers for clara.net's mailout.
>
> This could be relay.clara.net, and then you could
> use "v=spf1 a:relay.clara.net ?all" for tests.
>
> For some obscure reasons "a:relay.claranet.co.uk"
> is a proper subset of "a:relay.clara.net" at the
> moment, so maybe a more reliable solution for you
> would be to add "ip4:80.168.70.141/24" before both
> relays.

I've found from headers that claar use:-
relay1.mail.uk.clara.net (ip 80.168.70.141)
relay2.mail.uk.clara.net (ip 80.168.70.142)
relay3.mail.uk.clara.net (ip 80.168.70.143)

so for our domain (kilner-vacuum-lifting.com) i've got :-
kilner-vacuum-lifting.com. IN TXT "v=spf1 ip4:80.168.70.141/24
a:relay1.mail.uk.clara.net a:relay2.mail.uk.clara.net
a:relay3.mail.uk.clara.net -all"does this look ok?Thanks
scott,Frank---Outgoing mail is certified Virus Free.Checked by AVG
anti-virus system (http://www.grisoft.com).Version: 6.0.701 / Virus
Database: 458 - Release Date: 07/06/2004

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: SPF Config - Newbie [ In reply to ]

nobody at xyzzy

Jun 15, 2004, 1:51 PM

Post #5 of 7 (4690 views)

Permalink

Nigel Kilner wrote:

> kilner-vacuum-lifting.com. IN TXT "v=spf1
> ip4:80.168.70.141/24
> a:relay1.mail.uk.clara.net a:relay2.mail.uk.clara.net
> a:relay3.mail.uk.clara.net -all"

> does this look ok?

For testing you could start with ?all, watch the results for
some days, maybe play with <http://spf.pobox.com/why.html>,
and wait for feedback from your users before you go to ~all
resp. -all. With the shown sender policy you would have a
problem if clara.net suddenly changes the IPs and the names
of their mailouts.
Bye, Frank

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

RE: Re: SPF Config - Newbie [ In reply to ]

spf at kitterman

Jun 15, 2004, 1:52 PM

Post #6 of 7 (4652 views)

Permalink

> -----Original Message-----
> From: owner-spf-help@v2.listbox.com
> [mailto:owner-spf-help@v2.listbox.com]On Behalf Of Nigel Kilner
> Sent: Tuesday, June 15, 2004 4:27 PM
> To: spf-help@v2.listbox.com
> Subject: [spf-help] Re: SPF Config - Newbie
>
>
> > See Scott's answer, one way to find your relevant
> > smart hosts is to send a mail to somebody else
> > via your smart host, and then check the Received:
> > headers for clara.net's mailout.
> >
> > This could be relay.clara.net, and then you could
> > use "v=spf1 a:relay.clara.net ?all" for tests.
> >
> > For some obscure reasons "a:relay.claranet.co.uk"
> > is a proper subset of "a:relay.clara.net" at the
> > moment, so maybe a more reliable solution for you
> > would be to add "ip4:80.168.70.141/24" before both
> > relays.
>
> I've found from headers that claar use:-
> relay1.mail.uk.clara.net (ip 80.168.70.141)
> relay2.mail.uk.clara.net (ip 80.168.70.142)
> relay3.mail.uk.clara.net (ip 80.168.70.143)
>
> so for our domain (kilner-vacuum-lifting.com) i've got :-
> kilner-vacuum-lifting.com. IN TXT "v=spf1 ip4:80.168.70.141/24
> a:relay1.mail.uk.clara.net a:relay2.mail.uk.clara.net
> a:relay3.mail.uk.clara.net -all"does this look ok?Thanks
> scott,Frank

That should work, but if you are just starting out with SPF, I'd be cautious
about publishing -all to start. I would recommend publishing ?all (neutral)
or ~all (softfail) until you are sure you've got everything covered.

Did you also ask the ISP to publish their SPF own? Once they do that, your
odds go up. For example, I had guessed the record for Verizon similarly
before they published. I guessed:

ip4:206.46.170.0/24

Verizon published:

"v=spf1 ip4:206.46.170.0/24 ip4:206.46.128.33 ip4:206.46.128.101
ip4:209.84.13.21 ip4:209.84.13.20 ?all"

So you can see I missed a few. Also note that they are ?all at this point.

You might also read up a bit on the forwarder/legitimate forwarder issue.
Need to make sure you understand all the uses that your users have for their
e-mail address before you go -all.

Scott K

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: SPF Config - Newbie [ In reply to ]

spf at metro

Jun 16, 2004, 12:00 PM

Post #7 of 7 (4690 views)

Permalink

Hello,

On Tue, Jun 15, 2004 at 03:55:15PM +0100, Nigel wrote:
> I run a small company network. We get all our email from our isp.
> clara.net via ordinary dialup.
>
> I have installed all packages as described and have the spf-milter
> running with sendmail.. I can see that it is adding the following header
> to recieved emails:-

If you are receiving mail from your isp checking for spf makes no sense i think. Correct me if I'm wrong here, but i assume your isp has an incoming email server that accepts all your mail. You then get this mail by some means (pop, bsmtp, ?). It would only make sense if your isp does spf checking on the incoming mail.

Are you injecting mail from your server using something like fetchmail (which retrieves mail via pop and injects it into your local email server)? If so, your mail will always be from localhost, and spf checking is really not neccesary.

Koen

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com