Re: [SPAM:9.6] [SPAM:9.6] [SPAM:9.6] Off Topic - SPF - What a Disaster

[Kai Schaetzl <ma...@conactive.com>]

Christian Brel wrote on Wed, 24 Feb 2010 14:56:49 +0000:

> But that would reject *everything* that was not authenticated or in 'my
> networks'.

Indeed, that's the purpose. And it doesn't matter if you get the mail via 
25 or 587. 587 is just a convenience. Any other access to use your server 
for relaying should not be allowed at all. I really suggest you sit back 
and read the postfix documentation instead of questioning and questioning 
in the blue air. It's an absolute standard postfix configuration that you 
just seem to have not been made aware for years.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com

Re: [SPAM:9.6] [SPAM:9.6] [SPAM:9.6] Off Topic - SPF - What a Disaster

[Ned Slider <ne...@unixmail.co.uk>]

Christian Brel wrote:
> On Wed, 24 Feb 2010 17:31:19 +0100
> Kai Schaetzl <ma...@conactive.com> wrote:
> 
>> Christian Brel wrote on Wed, 24 Feb 2010 14:56:49 +0000:
>>
>>> But that would reject *everything* that was not authenticated or in
>>> 'my networks'.
>> Indeed, that's the purpose. And it doesn't matter if you get the mail
>> via 25 or 587. 587 is just a convenience. Any other access to use
>> your server for relaying should not be allowed at all. I really
>> suggest you sit back and read the postfix documentation instead of
>> questioning and questioning in the blue air. It's an absolute
>> standard postfix configuration that you just seem to have not been
>> made aware for years.
>>
>> Kai
>>
> 
> 
> I'm confused. The mail you have just sent to the list has;
> 'From: Kai Schaetzl <ma...@conactive.com>'
> 

Envelope sender, not the "from" address.

Re: [SPAM:9.6] [SPAM:9.6] [SPAM:9.6] Off Topic - SPF - What a Disaster

[Christian Brel <br...@copperproductions.co.uk>]

On Wed, 24 Feb 2010 17:31:19 +0100
Kai Schaetzl <ma...@conactive.com> wrote:

> Christian Brel wrote on Wed, 24 Feb 2010 14:56:49 +0000:
> 
> > But that would reject *everything* that was not authenticated or in
> > 'my networks'.
> 
> Indeed, that's the purpose. And it doesn't matter if you get the mail
> via 25 or 587. 587 is just a convenience. Any other access to use
> your server for relaying should not be allowed at all. I really
> suggest you sit back and read the postfix documentation instead of
> questioning and questioning in the blue air. It's an absolute
> standard postfix configuration that you just seem to have not been
> made aware for years.
> 
> Kai
> 


I'm confused. The mail you have just sent to the list has;
'From: Kai Schaetzl <ma...@conactive.com>'

Yet the server is:
mail.apache.org (hermes.apache.org [140.211.11.3])
#aka a forwarder in this context#

Now, if we do as you say and you have somebody else at conactive.com
who is subscribed to the list, what happens to this mail when it comes
across: 'reject my_domains,'

Granted SPF won't help anyone here (I don't think anyone would add
an entry for 140.211.11.3 in their SPF unless they were really keen)