Mailing List Archive

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

As long as both have the same IP address it will look like only one server on
the outside.
On Wednesday 28 July 2004 06:55, Harish Solanki wrote:
> Hi,
>
> I have two servers sending emails out, one is inside our LAN and other one
> is on the DMZ, all our incoming and outgoing emails go through our DMZ
> email (Gateway) server. I have all the necessary DNS entry which includes
> MX record and A record for our Gateway server, I do not have any MX record
> for our LAN server (It does has a public IP NATed to LAN IP). It does not
> receive any emails from outside directly. All incoming emails comes to
> Gateway and then are forwarded to our Mail server on LAN.
> We do use our email server on the LAN to send emails outside when we use
> our distribution list.
> I am confused as what to enter in 'The SPF Setup Wizard' under "Do any
> other servers send mail from reamined.on.ca?"
>
> Harish Solanki
>
>
>
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBB7JM7WlssggYu5IRAt51AJ9pIoI/AqPxDMylRZQ3+1eQbwEPJQCfZu6g
gdSV5fr/Fklq5A84Ko8Xzmw=
=mrU5
-----END PGP SIGNATURE-----

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: Re: DNS Entry for spf [ In reply to ]

Jul 28, 2004, 7:05 AM

Post #3 of 13 (6413 views)

Hi,

I think your question is answered here:

http://spf.pobox.com/faq.html#whitelist

Also note that where you receive your email is not important for what is
in your spf record.

As long as you 'whitelist' your internal mail server in your gateway server, and
as long as you're gateway server is permitted to send mail from the domains you
use when sending mail out from the lan server, you are ok.

If the gateway is all you use to send out mail "v=spf1 ip4:ip.of.gateway.here -all" will
suffice, or maybe with a ?all or ~all at the end for testing purposes.

As far as the wizard is concerned, there are no other servers sending out mail
for you, since you relay everything to the gateway which is the only thing receivers
on the internet will ever see.

Koen

On Wed, Jul 28, 2004 at 09:55:50AM -0400, Harish Solanki wrote:
> Hi,
>
> I have two servers sending emails out, one is inside our LAN and other one
> is on the DMZ, all our incoming and outgoing emails go through our DMZ email
> (Gateway) server. I have all the necessary DNS entry which includes MX
> record and A record for our Gateway server, I do not have any MX record for
> our LAN server (It does has a public IP NATed to LAN IP). It does not
> receive any emails from outside directly. All incoming emails comes to
> Gateway and then are forwarded to our Mail server on LAN.
> We do use our email server on the LAN to send emails outside when we use our
> distribution list.
> I am confused as what to enter in 'The SPF Setup Wizard' under "Do any other
> servers send mail from reamined.on.ca?"
>
> Harish Solanki
>
>
>
>
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your subscription,
> please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

RE: Re: DNS Entry for spf [ In reply to ]

Jul 28, 2004, 7:20 AM

Post #4 of 13 (6506 views)

When we use our distribution list all the email sent out goes through the
LAN server and is not relayed through Gateway and the client will see the
NAT public IP of the LAN server. I have to mention this IP also in SPF
record.

-----Original Message-----
From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
On Behalf Of Koen Martens
Sent: Wednesday, July 28, 2004 10:06 AM
To: spf-help@v2.listbox.com
Subject: Re: [spf-help] Re: DNS Entry for spf

Hi,

I think your question is answered here:

http://spf.pobox.com/faq.html#whitelist

Also note that where you receive your email is not important for what is
in your spf record.

As long as you 'whitelist' your internal mail server in your gateway server,
and
as long as you're gateway server is permitted to send mail from the domains
you
use when sending mail out from the lan server, you are ok.

If the gateway is all you use to send out mail "v=spf1
ip4:ip.of.gateway.here -all" will
suffice, or maybe with a ?all or ~all at the end for testing purposes.

As far as the wizard is concerned, there are no other servers sending out
mail
for you, since you relay everything to the gateway which is the only thing
receivers
on the internet will ever see.

Koen

On Wed, Jul 28, 2004 at 09:55:50AM -0400, Harish Solanki wrote:
> Hi,
>
> I have two servers sending emails out, one is inside our LAN and other one
> is on the DMZ, all our incoming and outgoing emails go through our DMZ
email
> (Gateway) server. I have all the necessary DNS entry which includes MX
> record and A record for our Gateway server, I do not have any MX record
for
> our LAN server (It does has a public IP NATed to LAN IP). It does not
> receive any emails from outside directly. All incoming emails comes to
> Gateway and then are forwarded to our Mail server on LAN.
> We do use our email server on the LAN to send emails outside when we use
our
> distribution list.
> I am confused as what to enter in 'The SPF Setup Wizard' under "Do any
other
> servers send mail from reamined.on.ca?"
>
> Harish Solanki
>
>
>
>
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your
subscription,
> please go to
http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: Re: DNS Entry for spf [ In reply to ]

Jul 28, 2004, 7:28 AM

Post #5 of 13 (6410 views)

Ok,

In that case you will have to list the nat ip indeed..

Koen

On Wed, Jul 28, 2004 at 10:20:46AM -0400, Harish Solanki wrote:
> When we use our distribution list all the email sent out goes through the
> LAN server and is not relayed through Gateway and the client will see the
> NAT public IP of the LAN server. I have to mention this IP also in SPF
> record.
>
> -----Original Message-----
> From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
> On Behalf Of Koen Martens
> Sent: Wednesday, July 28, 2004 10:06 AM
> To: spf-help@v2.listbox.com
> Subject: Re: [spf-help] Re: DNS Entry for spf
>
>
> Hi,
>
> I think your question is answered here:
>
> http://spf.pobox.com/faq.html#whitelist
>
> Also note that where you receive your email is not important for what is
> in your spf record.
>
> As long as you 'whitelist' your internal mail server in your gateway server,
> and
> as long as you're gateway server is permitted to send mail from the domains
> you
> use when sending mail out from the lan server, you are ok.
>
> If the gateway is all you use to send out mail "v=spf1
> ip4:ip.of.gateway.here -all" will
> suffice, or maybe with a ?all or ~all at the end for testing purposes.
>
> As far as the wizard is concerned, there are no other servers sending out
> mail
> for you, since you relay everything to the gateway which is the only thing
> receivers
> on the internet will ever see.
>
> Koen
>
> On Wed, Jul 28, 2004 at 09:55:50AM -0400, Harish Solanki wrote:
> > Hi,
> >
> > I have two servers sending emails out, one is inside our LAN and other one
> > is on the DMZ, all our incoming and outgoing emails go through our DMZ
> email
> > (Gateway) server. I have all the necessary DNS entry which includes MX
> > record and A record for our Gateway server, I do not have any MX record
> for
> > our LAN server (It does has a public IP NATed to LAN IP). It does not
> > receive any emails from outside directly. All incoming emails comes to
> > Gateway and then are forwarded to our Mail server on LAN.
> > We do use our email server on the LAN to send emails outside when we use
> our
> > distribution list.
> > I am confused as what to enter in 'The SPF Setup Wizard' under "Do any
> other
> > servers send mail from reamined.on.ca?"
> >
> > Harish Solanki
> >
> >
> >
> >
> >
> > -------
> > Archives at http://archives.listbox.com/spf-help/current/
> > Donate! http://spf.pobox.com/donations.html
> > To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> > please go to
> http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
> --
> K.F.J. Martens, Sonologic, http://www.sonologic.nl/
> Networking, embedded systems, unix expertise, artificial intelligence.
> Public PGP key: http://www.metro.cx/pubkey-gmc.asc
> Wondering about the funny attachment your mail program
> can't read? Visit http://www.openpgp.org/
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
>
>
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your subscription,
> please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

RE: Re: DNS Entry for spf [ In reply to ]

Jul 28, 2004, 8:06 AM

Post #6 of 13 (6475 views)

Do I also have to add the MX and A record in my DNS server for my Internal
Mail server?

-----Original Message-----
From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
On Behalf Of Koen Martens
Sent: Wednesday, July 28, 2004 10:28 AM
To: spf-help@v2.listbox.com
Subject: Re: [spf-help] Re: DNS Entry for spf

Ok,

In that case you will have to list the nat ip indeed..

Koen

On Wed, Jul 28, 2004 at 10:20:46AM -0400, Harish Solanki wrote:
> When we use our distribution list all the email sent out goes through the
> LAN server and is not relayed through Gateway and the client will see the
> NAT public IP of the LAN server. I have to mention this IP also in SPF
> record.
>
> -----Original Message-----
> From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
> On Behalf Of Koen Martens
> Sent: Wednesday, July 28, 2004 10:06 AM
> To: spf-help@v2.listbox.com
> Subject: Re: [spf-help] Re: DNS Entry for spf
>
>
> Hi,
>
> I think your question is answered here:
>
> http://spf.pobox.com/faq.html#whitelist
>
> Also note that where you receive your email is not important for what is
> in your spf record.
>
> As long as you 'whitelist' your internal mail server in your gateway
server,
> and
> as long as you're gateway server is permitted to send mail from the
domains
> you
> use when sending mail out from the lan server, you are ok.
>
> If the gateway is all you use to send out mail "v=spf1
> ip4:ip.of.gateway.here -all" will
> suffice, or maybe with a ?all or ~all at the end for testing purposes.
>
> As far as the wizard is concerned, there are no other servers sending out
> mail
> for you, since you relay everything to the gateway which is the only thing
> receivers
> on the internet will ever see.
>
> Koen
>
> On Wed, Jul 28, 2004 at 09:55:50AM -0400, Harish Solanki wrote:
> > Hi,
> >
> > I have two servers sending emails out, one is inside our LAN and other
one
> > is on the DMZ, all our incoming and outgoing emails go through our DMZ
> email
> > (Gateway) server. I have all the necessary DNS entry which includes MX
> > record and A record for our Gateway server, I do not have any MX record
> for
> > our LAN server (It does has a public IP NATed to LAN IP). It does not
> > receive any emails from outside directly. All incoming emails comes to
> > Gateway and then are forwarded to our Mail server on LAN.
> > We do use our email server on the LAN to send emails outside when we use
> our
> > distribution list.
> > I am confused as what to enter in 'The SPF Setup Wizard' under "Do any
> other
> > servers send mail from reamined.on.ca?"
> >
> > Harish Solanki
> >
> >
> >
> >
> >
> > -------
> > Archives at http://archives.listbox.com/spf-help/current/
> > Donate! http://spf.pobox.com/donations.html
> > To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> > please go to
> http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
> --
> K.F.J. Martens, Sonologic, http://www.sonologic.nl/
> Networking, embedded systems, unix expertise, artificial intelligence.
> Public PGP key: http://www.metro.cx/pubkey-gmc.asc
> Wondering about the funny attachment your mail program
> can't read? Visit http://www.openpgp.org/
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to
http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
>
>
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your
subscription,
> please go to
http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: Re: DNS Entry for spf [ In reply to ]

nkadel at merl

Jul 28, 2004, 8:09 AM

Post #7 of 13 (6489 views)

----- Original Message -----
From: "Koen Martens" <spf@metro.cx>
To: <spf-help@v2.listbox.com>
Sent: Wednesday, July 28, 2004 10:05 AM
Subject: Re: [spf-help] Re: DNS Entry for spf

> Hi,
>
> I think your question is answered here:
>
> http://spf.pobox.com/faq.html#whitelist
>
> Also note that where you receive your email is not important for what is
> in your spf record.
>
> As long as you 'whitelist' your internal mail server in your gateway
server, and
> as long as you're gateway server is permitted to send mail from the
domains you
> use when sending mail out from the lan server, you are ok.
>
> If the gateway is all you use to send out mail "v=spf1
ip4:ip.of.gateway.here -all" will
> suffice, or maybe with a ?all or ~all at the end for testing purposes.
>
> As far as the wizard is concerned, there are no other servers sending out
mail
> for you, since you relay everything to the gateway which is the only thing
receivers
> on the internet will ever see.

Note that if you connect to a remote location via VPN and expect email to be
transmitted between distinct SMTP servers for the two locations over the
VPN, either the remote site will need to whitelist you as well or you will
need to publish internal DNS for them that includes distinct TXT records for
your internal mail servers.

I frankly found it easier to publish the internal mail servers IP addresses
in my external DNS and be consistent about my TXT records.

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: Re: DNS Entry for spf [ In reply to ]

Jul 28, 2004, 8:11 AM

Post #8 of 13 (6441 views)

Sorry, i'm not sure what you mean here:

do you mean 'do i have to put mx and a in my spf record' or do you mean 'do i have to
have MX and A records for my internal mail server?'.

Assuming you meant that last one: it is not neccesarry. All that is neccesary is that
for the domains you send mail out from using your internal mail server you add a
mechanism in the spf record that allows that server to send mail (which in your case means
you will have to add the nat ip to the spf records). Having MX records is only neccesary
if you use the 'mx' mechanism in the SPF record. Having an A record is
only neccesarry if you use the 'a' mechanism in the spf record. If you just explicitly
put the ip in the spf record with the 'ip4' mechanism, nothing else is needed.

Koen

On Wed, Jul 28, 2004 at 11:06:32AM -0400, Harish Solanki wrote:
> Do I also have to add the MX and A record in my DNS server for my Internal
> Mail server?
>
>
>
> -----Original Message-----
> From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
> On Behalf Of Koen Martens
> Sent: Wednesday, July 28, 2004 10:28 AM
> To: spf-help@v2.listbox.com
> Subject: Re: [spf-help] Re: DNS Entry for spf
>
>
> Ok,
>
> In that case you will have to list the nat ip indeed..
>
> Koen
>
> On Wed, Jul 28, 2004 at 10:20:46AM -0400, Harish Solanki wrote:
> > When we use our distribution list all the email sent out goes through the
> > LAN server and is not relayed through Gateway and the client will see the
> > NAT public IP of the LAN server. I have to mention this IP also in SPF
> > record.
> >
> > -----Original Message-----
> > From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
> > On Behalf Of Koen Martens
> > Sent: Wednesday, July 28, 2004 10:06 AM
> > To: spf-help@v2.listbox.com
> > Subject: Re: [spf-help] Re: DNS Entry for spf
> >
> >
> > Hi,
> >
> > I think your question is answered here:
> >
> > http://spf.pobox.com/faq.html#whitelist
> >
> > Also note that where you receive your email is not important for what is
> > in your spf record.
> >
> > As long as you 'whitelist' your internal mail server in your gateway
> server,
> > and
> > as long as you're gateway server is permitted to send mail from the
> domains
> > you
> > use when sending mail out from the lan server, you are ok.
> >
> > If the gateway is all you use to send out mail "v=spf1
> > ip4:ip.of.gateway.here -all" will
> > suffice, or maybe with a ?all or ~all at the end for testing purposes.
> >
> > As far as the wizard is concerned, there are no other servers sending out
> > mail
> > for you, since you relay everything to the gateway which is the only thing
> > receivers
> > on the internet will ever see.
> >
> > Koen
> >
> > On Wed, Jul 28, 2004 at 09:55:50AM -0400, Harish Solanki wrote:
> > > Hi,
> > >
> > > I have two servers sending emails out, one is inside our LAN and other
> one
> > > is on the DMZ, all our incoming and outgoing emails go through our DMZ
> > email
> > > (Gateway) server. I have all the necessary DNS entry which includes MX
> > > record and A record for our Gateway server, I do not have any MX record
> > for
> > > our LAN server (It does has a public IP NATed to LAN IP). It does not
> > > receive any emails from outside directly. All incoming emails comes to
> > > Gateway and then are forwarded to our Mail server on LAN.
> > > We do use our email server on the LAN to send emails outside when we use
> > our
> > > distribution list.
> > > I am confused as what to enter in 'The SPF Setup Wizard' under "Do any
> > other
> > > servers send mail from reamined.on.ca?"
> > >
> > > Harish Solanki
> > >
> > >
> > >
> > >
> > >
> > > -------
> > > Archives at http://archives.listbox.com/spf-help/current/
> > > Donate! http://spf.pobox.com/donations.html
> > > To unsubscribe, change your address, or temporarily deactivate your
> > subscription,
> > > please go to
> > http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
> >
> > --
> > K.F.J. Martens, Sonologic, http://www.sonologic.nl/
> > Networking, embedded systems, unix expertise, artificial intelligence.
> > Public PGP key: http://www.metro.cx/pubkey-gmc.asc
> > Wondering about the funny attachment your mail program
> > can't read? Visit http://www.openpgp.org/
> >
> > -------
> > Archives at http://archives.listbox.com/spf-help/current/
> > Donate! http://spf.pobox.com/donations.html
> > To unsubscribe, change your address, or temporarily deactivate your
> > subscription,
> > please go to
> http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
> >
> >
> >
> >
> > -------
> > Archives at http://archives.listbox.com/spf-help/current/
> > Donate! http://spf.pobox.com/donations.html
> > To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> > please go to
> http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
> --
> K.F.J. Martens, Sonologic, http://www.sonologic.nl/
> Networking, embedded systems, unix expertise, artificial intelligence.
> Public PGP key: http://www.metro.cx/pubkey-gmc.asc
> Wondering about the funny attachment your mail program
> can't read? Visit http://www.openpgp.org/
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
>
>
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your subscription,
> please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: Re: DNS Entry for spf [ In reply to ]

Jul 28, 2004, 8:13 AM

Post #9 of 13 (6490 views)

On Wed, Jul 28, 2004 at 11:09:53AM -0400, Nico Kadel-Garcia wrote:
> I frankly found it easier to publish the internal mail servers IP addresses
> in my external DNS and be consistent about my TXT records.

Of course, it can be done and is easier. But it is not common to publish internal
ip's on publicly available dns servers. You basically give away potentially useful
information for evil hackers.

Koen

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: Re: DNS Entry for spf [ In reply to ]

nkadel at merl

Jul 28, 2004, 8:22 AM

Post #10 of 13 (6487 views)

----- Original Message -----
From: "Koen Martens" <spf@metro.cx>
To: <spf-help@v2.listbox.com>
Sent: Wednesday, July 28, 2004 11:13 AM
Subject: Re: [spf-help] Re: DNS Entry for spf

> On Wed, Jul 28, 2004 at 11:09:53AM -0400, Nico Kadel-Garcia wrote:
> > I frankly found it easier to publish the internal mail servers IP
addresses
> > in my external DNS and be consistent about my TXT records.
>
> Of course, it can be done and is easier. But it is not common to publish
internal
> ip's on publicly available dns servers. You basically give away
potentially useful
> information for evil hackers.

Well, yes. You left out the bits about the VPN setups. For example, if the
remote VPN location starts doing SPF and is not pulling their DNS from my
internal DNS but rather from the external DNS, or I don't want to make them
maintain a distinct hand-built whitelist, it makes life easier to deal with
to simply keep it consistent rather than making them pull my internal DNS.

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

RE: Re: DNS Entry for spf [ In reply to ]

Jul 28, 2004, 9:08 AM

Post #11 of 13 (6489 views)

Thanks! Koen
I have added the SPF record with 'ip4' mechanism. How can I test if it is
ok, I would like to test for internal as well as for gateway server also.

-----Original Message-----
From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
On Behalf Of Koen Martens
Sent: Wednesday, July 28, 2004 11:11 AM
To: spf-help@v2.listbox.com
Subject: Re: [spf-help] Re: DNS Entry for spf

Sorry, i'm not sure what you mean here:

do you mean 'do i have to put mx and a in my spf record' or do you mean 'do
i have to
have MX and A records for my internal mail server?'.

Assuming you meant that last one: it is not neccesarry. All that is
neccesary is that
for the domains you send mail out from using your internal mail server you
add a
mechanism in the spf record that allows that server to send mail (which in
your case means
you will have to add the nat ip to the spf records). Having MX records is
only neccesary
if you use the 'mx' mechanism in the SPF record. Having an A record is
only neccesarry if you use the 'a' mechanism in the spf record. If you just
explicitly
put the ip in the spf record with the 'ip4' mechanism, nothing else is
needed.

Koen

On Wed, Jul 28, 2004 at 11:06:32AM -0400, Harish Solanki wrote:
> Do I also have to add the MX and A record in my DNS server for my Internal
> Mail server?
>
>
>
> -----Original Message-----
> From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
> On Behalf Of Koen Martens
> Sent: Wednesday, July 28, 2004 10:28 AM
> To: spf-help@v2.listbox.com
> Subject: Re: [spf-help] Re: DNS Entry for spf
>
>
> Ok,
>
> In that case you will have to list the nat ip indeed..
>
> Koen
>
> On Wed, Jul 28, 2004 at 10:20:46AM -0400, Harish Solanki wrote:
> > When we use our distribution list all the email sent out goes through
the
> > LAN server and is not relayed through Gateway and the client will see
the
> > NAT public IP of the LAN server. I have to mention this IP also in SPF
> > record.
> >
> > -----Original Message-----
> > From: owner-spf-help@v2.listbox.com
[mailto:owner-spf-help@v2.listbox.com]
> > On Behalf Of Koen Martens
> > Sent: Wednesday, July 28, 2004 10:06 AM
> > To: spf-help@v2.listbox.com
> > Subject: Re: [spf-help] Re: DNS Entry for spf
> >
> >
> > Hi,
> >
> > I think your question is answered here:
> >
> > http://spf.pobox.com/faq.html#whitelist
> >
> > Also note that where you receive your email is not important for what is

> > in your spf record.
> >
> > As long as you 'whitelist' your internal mail server in your gateway
> server,
> > and
> > as long as you're gateway server is permitted to send mail from the
> domains
> > you
> > use when sending mail out from the lan server, you are ok.
> >
> > If the gateway is all you use to send out mail "v=spf1
> > ip4:ip.of.gateway.here -all" will
> > suffice, or maybe with a ?all or ~all at the end for testing purposes.
> >
> > As far as the wizard is concerned, there are no other servers sending
out
> > mail
> > for you, since you relay everything to the gateway which is the only
thing
> > receivers
> > on the internet will ever see.
> >
> > Koen
> >
> > On Wed, Jul 28, 2004 at 09:55:50AM -0400, Harish Solanki wrote:
> > > Hi,
> > >
> > > I have two servers sending emails out, one is inside our LAN and other
> one
> > > is on the DMZ, all our incoming and outgoing emails go through our DMZ
> > email
> > > (Gateway) server. I have all the necessary DNS entry which includes MX
> > > record and A record for our Gateway server, I do not have any MX
record
> > for
> > > our LAN server (It does has a public IP NATed to LAN IP). It does not
> > > receive any emails from outside directly. All incoming emails comes to
> > > Gateway and then are forwarded to our Mail server on LAN.
> > > We do use our email server on the LAN to send emails outside when we
use
> > our
> > > distribution list.
> > > I am confused as what to enter in 'The SPF Setup Wizard' under "Do any
> > other
> > > servers send mail from reamined.on.ca?"
> > >
> > > Harish Solanki
> > >
> > >
> > >
> > >
> > >
> > > -------
> > > Archives at http://archives.listbox.com/spf-help/current/
> > > Donate! http://spf.pobox.com/donations.html
> > > To unsubscribe, change your address, or temporarily deactivate your
> > subscription,
> > > please go to
> > http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
> >
> > --
> > K.F.J. Martens, Sonologic, http://www.sonologic.nl/
> > Networking, embedded systems, unix expertise, artificial intelligence.
> > Public PGP key: http://www.metro.cx/pubkey-gmc.asc
> > Wondering about the funny attachment your mail program
> > can't read? Visit http://www.openpgp.org/
> >
> > -------
> > Archives at http://archives.listbox.com/spf-help/current/
> > Donate! http://spf.pobox.com/donations.html
> > To unsubscribe, change your address, or temporarily deactivate your
> > subscription,
> > please go to
> http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
> >
> >
> >
> >
> > -------
> > Archives at http://archives.listbox.com/spf-help/current/
> > Donate! http://spf.pobox.com/donations.html
> > To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> > please go to
> http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
> --
> K.F.J. Martens, Sonologic, http://www.sonologic.nl/
> Networking, embedded systems, unix expertise, artificial intelligence.
> Public PGP key: http://www.metro.cx/pubkey-gmc.asc
> Wondering about the funny attachment your mail program
> can't read? Visit http://www.openpgp.org/
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to
http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
>
>
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your
subscription,
> please go to
http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

Re: Re: DNS Entry for spf [ In reply to ]

Jul 28, 2004, 11:34 AM

Post #12 of 13 (6403 views)

There are a couple of tools you can use:

http://spf.pobox.com/faq.html#checkers

and

http://spf.pobox.com/faq.html#tools

tell you where they are!

Koen

On Wed, Jul 28, 2004 at 12:08:03PM -0400, Harish Solanki wrote:
> Thanks! Koen
> I have added the SPF record with 'ip4' mechanism. How can I test if it is
> ok, I would like to test for internal as well as for gateway server also.
>
>
> -----Original Message-----
> From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
> On Behalf Of Koen Martens
> Sent: Wednesday, July 28, 2004 11:11 AM
> To: spf-help@v2.listbox.com
> Subject: Re: [spf-help] Re: DNS Entry for spf
>
>
> Sorry, i'm not sure what you mean here:
>
> do you mean 'do i have to put mx and a in my spf record' or do you mean 'do
> i have to
> have MX and A records for my internal mail server?'.
>
> Assuming you meant that last one: it is not neccesarry. All that is
> neccesary is that
> for the domains you send mail out from using your internal mail server you
> add a
> mechanism in the spf record that allows that server to send mail (which in
> your case means
> you will have to add the nat ip to the spf records). Having MX records is
> only neccesary
> if you use the 'mx' mechanism in the SPF record. Having an A record is
> only neccesarry if you use the 'a' mechanism in the spf record. If you just
> explicitly
> put the ip in the spf record with the 'ip4' mechanism, nothing else is
> needed.
>
> Koen
>
> On Wed, Jul 28, 2004 at 11:06:32AM -0400, Harish Solanki wrote:
> > Do I also have to add the MX and A record in my DNS server for my Internal
> > Mail server?
> >
> >
> >
> > -----Original Message-----
> > From: owner-spf-help@v2.listbox.com [mailto:owner-spf-help@v2.listbox.com]
> > On Behalf Of Koen Martens
> > Sent: Wednesday, July 28, 2004 10:28 AM
> > To: spf-help@v2.listbox.com
> > Subject: Re: [spf-help] Re: DNS Entry for spf
> >
> >
> > Ok,
> >
> > In that case you will have to list the nat ip indeed..
> >
> > Koen
> >
> > On Wed, Jul 28, 2004 at 10:20:46AM -0400, Harish Solanki wrote:
> > > When we use our distribution list all the email sent out goes through
> the
> > > LAN server and is not relayed through Gateway and the client will see
> the
> > > NAT public IP of the LAN server. I have to mention this IP also in SPF
> > > record.
> > >
> > > -----Original Message-----
> > > From: owner-spf-help@v2.listbox.com
> [mailto:owner-spf-help@v2.listbox.com]
> > > On Behalf Of Koen Martens
> > > Sent: Wednesday, July 28, 2004 10:06 AM
> > > To: spf-help@v2.listbox.com
> > > Subject: Re: [spf-help] Re: DNS Entry for spf
> > >
> > >
> > > Hi,
> > >
> > > I think your question is answered here:
> > >
> > > http://spf.pobox.com/faq.html#whitelist
> > >
> > > Also note that where you receive your email is not important for what is
>
> > > in your spf record.
> > >
> > > As long as you 'whitelist' your internal mail server in your gateway
> > server,
> > > and
> > > as long as you're gateway server is permitted to send mail from the
> > domains
> > > you
> > > use when sending mail out from the lan server, you are ok.
> > >
> > > If the gateway is all you use to send out mail "v=spf1
> > > ip4:ip.of.gateway.here -all" will
> > > suffice, or maybe with a ?all or ~all at the end for testing purposes.
> > >
> > > As far as the wizard is concerned, there are no other servers sending
> out
> > > mail
> > > for you, since you relay everything to the gateway which is the only
> thing
> > > receivers
> > > on the internet will ever see.
> > >
> > > Koen
> > >
> > > On Wed, Jul 28, 2004 at 09:55:50AM -0400, Harish Solanki wrote:
> > > > Hi,
> > > >
> > > > I have two servers sending emails out, one is inside our LAN and other
> > one
> > > > is on the DMZ, all our incoming and outgoing emails go through our DMZ
> > > email
> > > > (Gateway) server. I have all the necessary DNS entry which includes MX
> > > > record and A record for our Gateway server, I do not have any MX
> record
> > > for
> > > > our LAN server (It does has a public IP NATed to LAN IP). It does not
> > > > receive any emails from outside directly. All incoming emails comes to
> > > > Gateway and then are forwarded to our Mail server on LAN.
> > > > We do use our email server on the LAN to send emails outside when we
> use
> > > our
> > > > distribution list.
> > > > I am confused as what to enter in 'The SPF Setup Wizard' under "Do any
> > > other
> > > > servers send mail from reamined.on.ca?"
> > > >
> > > > Harish Solanki
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > -------
> > > > Archives at http://archives.listbox.com/spf-help/current/
> > > > Donate! http://spf.pobox.com/donations.html
> > > > To unsubscribe, change your address, or temporarily deactivate your
> > > subscription,
> > > > please go to
> > > http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
> > >
> > > --
> > > K.F.J. Martens, Sonologic, http://www.sonologic.nl/
> > > Networking, embedded systems, unix expertise, artificial intelligence.
> > > Public PGP key: http://www.metro.cx/pubkey-gmc.asc
> > > Wondering about the funny attachment your mail program
> > > can't read? Visit http://www.openpgp.org/
> > >
> > > -------
> > > Archives at http://archives.listbox.com/spf-help/current/
> > > Donate! http://spf.pobox.com/donations.html
> > > To unsubscribe, change your address, or temporarily deactivate your
> > > subscription,
> > > please go to
> > http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
> > >
> > >
> > >
> > >
> > > -------
> > > Archives at http://archives.listbox.com/spf-help/current/
> > > Donate! http://spf.pobox.com/donations.html
> > > To unsubscribe, change your address, or temporarily deactivate your
> > subscription,
> > > please go to
> > http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
> >
> > --
> > K.F.J. Martens, Sonologic, http://www.sonologic.nl/
> > Networking, embedded systems, unix expertise, artificial intelligence.
> > Public PGP key: http://www.metro.cx/pubkey-gmc.asc
> > Wondering about the funny attachment your mail program
> > can't read? Visit http://www.openpgp.org/
> >
> > -------
> > Archives at http://archives.listbox.com/spf-help/current/
> > Donate! http://spf.pobox.com/donations.html
> > To unsubscribe, change your address, or temporarily deactivate your
> > subscription,
> > please go to
> http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
> >
> >
> >
> >
> > -------
> > Archives at http://archives.listbox.com/spf-help/current/
> > Donate! http://spf.pobox.com/donations.html
> > To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> > please go to
> http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
> --
> K.F.J. Martens, Sonologic, http://www.sonologic.nl/
> Networking, embedded systems, unix expertise, artificial intelligence.
> Public PGP key: http://www.metro.cx/pubkey-gmc.asc
> Wondering about the funny attachment your mail program
> can't read? Visit http://www.openpgp.org/
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com
>
>
>
>
> -------
> Archives at http://archives.listbox.com/spf-help/current/
> Donate! http://spf.pobox.com/donations.html
> To unsubscribe, change your address, or temporarily deactivate your subscription,
> please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

--
K.F.J. Martens, Sonologic, http://www.sonologic.nl/
Networking, embedded systems, unix expertise, artificial intelligence.
Public PGP key: http://www.metro.cx/pubkey-gmc.asc
Wondering about the funny attachment your mail program
can't read? Visit http://www.openpgp.org/

-------
Archives at http://archives.listbox.com/spf-help/current/
Donate! http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-help@v2.listbox.com

RE: Re: DNS Entry for spf [ In reply to ]

Jul 28, 2004, 11:59 AM

Post #13 of 13 (6480 views)