Mailing List Archive: Problem I cant understand.

Hello,

I have setup the following SPF in my DNS (mrzaz.com):
"v=spf1 mx ip4:213.114.187.128/25 -all"

FACTS:
- Using DynDNS domain MRZAZ.COM
- MX = mrzaz.com (resolving to my IP 213.114.187.174)
- Mailserver is sitting on the 213.114.187.128/25 network. (current IP
213.114.187.175)
- All users in mailserver is using "Authenticated SMTP" and no relay
permitted unless AUTH. (AUTH LOGIN CRAM-MD5)
- Must send all mail through SMTP.BREDBAND.NET (My ISPs mailgate) due to
blocking of port 25
if source-ip = myISP
- SMTP.BREDBAND.NET = Only SMTP relay, NOT a forwarder. (only adds a
"Received: from mxfep01.bredband.com ([195.54.107.70])")
- Running "Alt-N MDaemon PRO 7.1.2"

This is how a session could look like:

---
X-Message-Info: 6sSXyD95QpVVK/F7kvINgcBDMfDAuJSw
Received: from mxfep01.bredband.com ([195.54.107.70]) by mc4-f17.hotmail.com
with Microsoft SMTPSVC(5.0.2195.6824);
Mon, 12 Jul 2004 07:15:18 -0700
Received: from mrzaz.com ([213.114.187.175] [213.114.187.175])
by mxfep01.bredband.com with ESMTP
id <20040712141509.ODQX3131.mxfep01.bredband.com@mrzaz.com>
for <mr_zaz@hotmail.com>; Mon, 12 Jul 2004 16:15:09 +0200
Received: from hubbe by mrzaz.com
(MDaemon.PRO.v7.1.2.R)
with ESMTP id md50000008710.msg
for <mr_zaz@hotmail.com>; Mon, 12 Jul 2004 16:15:11 +0200
From: "Dan Lundqvist" <danne@mrzaz.com>
To: <mr_zaz@hotmail.com>
Subject: test
Date: Mon, 12 Jul 2004 16:15:06 +0200
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Thread-Index: AcRoGqFmmnu6OPv7ReKfeb/qJ/EMrg==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
X-Authenticated-Sender: danne@mrzaz.com
X-Spam-Processed: mrzaz.com, Mon, 12 Jul 2004 16:15:11 +0200
(not processed: message from valid local sender)
X-Return-Path: danne@mrzaz.com
X-MDaemon-Deliver-To: mr_zaz@hotmail.com
Reply-To: danne@mrzaz.com
Message-ID: <MDAEMON-F200407121615.AA1508732md50000000739@mrzaz.com>
X-MDAV-Processed: mrzaz.com, Mon, 12 Jul 2004 16:15:12 +0200
Return-Path: danne@mrzaz.com
X-OriginalArrivalTime: 12 Jul 2004 14:15:18.0795 (UTC)
FILETIME=[A90E6DB0:01C4681A]
---

If I have understanded the SPF concept, as long as it finds the following
key
components in the mail transcript:

"Received: from mrzaz.com ([213.114.187.175] [213.114.187.175])"
"Return-Path: danne@mrzaz.com"
"From: "Dan Lundqvist" <danne@mrzaz.com>"
"To: <mr_zaz@hotmail.com>"
"X-Authenticated-Sender: danne@mrzaz.com"

then, in my opinion, it should result in a PASS but when I do a test
it will show as failed on the "Received: from mxfep01.bredband.com
([195.54.107.70])"

Could someone please explain WHY this is failing ?

I would like NOT to enter "a:mxfep01.bredband.com" to my SPF record because
this is an open SMTP for users within my ISPs network and potentally someone
could spoof and pretend to be "danne@mrzaz.com" and send it directly to
this SMTP and it would be validated as PASS due to the
"a:mxfep01.bredband.com".

If getting a bit confused now... (Thought I had a grip of SPF, but aparantly
not)

During investigation, I have the "-all" to "~all" for now.

Best regards
Dan Lundqvist

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

On Mon, Jul 12, 2004 at 05:30:03PM +0200, Dan Lundqvist wrote:
> I would like NOT to enter "a:mxfep01.bredband.com" to my SPF record because
> this is an open SMTP for users within my ISPs network and potentally someone
> could spoof and pretend to be "danne@mrzaz.com" and send it directly to
> this SMTP and it would be validated as PASS due to the
> "a:mxfep01.bredband.com".

I'm afraid you will have to. SPF looks at the envelope sender from. This is what the receiving mta gets with the MAIL FROM line in the smtp session and compares this with the ip of the connecting MTA. Of course, if you send through your ISP, receivers will check the spf record of the domain part of your 'bla@mrzaz.com' with the ip of your isp's outgoing mail server.

Koen

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com