Mailing List Archive: Incorrect reporting of SPF record

Hi,

I am an ISP based in the UK and I have just started setting up SPF records for my clients. One that I have done has the record

v=spf1 a:post.dragonnet.co.uk a:mail.dragonnet.co.uk/24 a:local.systemsaxis.co.uk/29 -all

local.systemsaxis.co.uk resolves to the IP address of the server they use to send mail, the other records are my normal send mail servers. They have sent a message to mark@officeservices.uk.com

and have got an error back as follows

Subject: Undeliverable: Major New Software Release from Systems AXIS
Your message did not reach some or all of the intended recipients.
Subject: Major New Software Release from Systems AXIS
Sent: 01/07/2004 12:20
The following recipient(s) could not be reached:
mark@officeservices.uk.com on 01/07/2004 12:29
You do not have permission to send to this recipient. For assistance, contact your system administrator.
< c100036.tdmgroup.net #5.7.1 SMTP; 550 5.7.1 <mark@officeservices.f2s.com>... Please see http://spf.pobox.com/why.html?sender=sales%40systemsaxis.co.uk&ip=81.89.135.76&receiver=i-194-106-33-236.freedom2surf.net>

The reporting web site shows the following:-

i-194-106-33-236.freedom2surf.net rejected a message claiming to be from sales@systemsaxis.co.uk.
i-194-106-33-236.freedom2surf.net saw a message coming from the IP address 81.89.135.76 which is c100036.tdmgroup.net; the sender claimed to be sales@systemsaxis.co.uk.
However, systemsaxis.co.uk has announced using SPF that it does not send mail out through 81.89.135.76. That is why the mail was rejected.

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Hi,

Apparently they send out mail from some server that is not in the list
in your spf record. I did a dig for each tree of them, and found they
all start with 212., whereas the ip from which the email was sent
apparently is 81.89.135.76, so it seems this is perfectly allright.

Doing a reverse for the ip from which the email was sent, I see:

76.135.89.81.in-addr.arpa. 3D IN PTR c100036.tdmgroup.net.

So several things could be going on here. Is their outgoing mail server
sending through a smart host? Are employees of the customer sending out
mail from their home pc's?? Etc..

Maybe you should consider setting up authenticated smtp for your
customers to send mail.

Kind regards,

Koen

On Sat, Jul 10, 2004 at 10:04:46PM +0100, David Christy wrote:
> Hi,
>
> I am an ISP based in the UK and I have just started setting up SPF records for my clients. One that I have done has the record
>
> v=spf1 a:post.dragonnet.co.uk a:mail.dragonnet.co.uk/24 a:local.systemsaxis.co.uk/29 -all
>
> local.systemsaxis.co.uk resolves to the IP address of the server they use to send mail, the other records are my normal send mail servers. They have sent a message to mark@officeservices.uk.com
>
> and have got an error back as follows
>
> Subject: Undeliverable: Major New Software Release from Systems AXIS
> Your message did not reach some or all of the intended recipients.
> Subject: Major New Software Release from Systems AXIS
> Sent: 01/07/2004 12:20
> The following recipient(s) could not be reached:
> mark@officeservices.uk.com on 01/07/2004 12:29
> You do not have permission to send to this recipient. For assistance, contact your system administrator.
> < c100036.tdmgroup.net #5.7.1 SMTP; 550 5.7.1 <mark@officeservices.f2s.com>... Please see http://spf.pobox.com/why.html?sender=sales%40systemsaxis.co.uk&ip=81.89.135.76&receiver=i-194-106-33-236.freedom2surf.net>
>
> The reporting web site shows the following:-
>
> i-194-106-33-236.freedom2surf.net rejected a message claiming to be from sales@systemsaxis.co.uk.
> i-194-106-33-236.freedom2surf.net saw a message coming from the IP address 81.89.135.76 which is c100036.tdmgroup.net; the sender claimed to be sales@systemsaxis.co.uk.
> However, systemsaxis.co.uk has announced using SPF that it does not send mail out through 81.89.135.76. That is why the mail was rejected.
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your subscription,
> please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com