You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Josef Karliak <ka...@ajetaci.cz> on 2012/07/11 21:34:13 UTC
Spamassassin and SPF records with "+all"
Good evening,
within a few days we've spams from domains that has "+all" in the
TXT spf record. I was thinking that I'll make a plugin that check this
records and add some point to this email, but I do not know perl. Are
there some other options ? Does anybody solve this problems ?
Thanks and best regards
J.Karliak.
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin and SPF records with "+all"
Posted by Benny Pedersen <me...@junc.org>.
Den 2012-07-11 21:34, Josef Karliak skrev:
> within a few days we've spams from domains that has "+all" in the
> TXT spf record.
spamassassin does give -100 in score for spf_pass ? :=)
> I was thinking that I'll make a plugin that check this
> records and add some point to this email, but I do not know perl. Are
> there some other options ? Does anybody solve this problems ?
waste of time :/
if you have a real unresolved problem pastbin it so i can fly over it,
but agre spammers can and do use +all and its even still valid spf
record, if you like to make spf better join the spf dev maillist and
show your patches to them
my own spf meta:
meta META_SPF_FULL_PASS (SPF_HELO_PASS && SPF_PASS)
meta META_SPF_GREYLIST (SPF_HELO_PASS && !SPF_PASS)
score META_SPF_FULL_PASS -1.5
score META_SPF_GREYLIST 0.5
as others says SPF_PASS is not the same as email is not spam
Re: Spamassassin and SPF records with "+all"
Posted by Benny Pedersen <me...@junc.org>.
Den 2012-07-12 08:50, Robert Schetterer skrev:
> i wouldnt invest time in it
> spf does not solve spam problems in general, its may only one from
> many
> parameters for spam tagging check
currect
> any spammer can have valid spf records, also strict ones
> also any legal mail sender
currect
> in deed many spammers have valid spf entries in dns
currect
> in case of hacked accounts at big mailers like yahoo,aol etc
> you have also valid dkim too, so at the end body content filtering
> needs
> to be done however
this is not an spf issue
where is the pastebin samples of spammers benefit from spf_pass ?
Re: Spamassassin and SPF records with "+all" [learning per domain
worth of SPF record]
Posted by Robert Schetterer <ro...@schetterer.org>.
Am 12.07.2012 09:08, schrieb Andrzej A. Filip:
> On 07/12/2012 09:01 AM, David F. Skoll wrote:
>> On Thu, 12 Jul 2012 08:50:59 +0200
>> Robert Schetterer <ro...@schetterer.org> wrote:
>>
>>> spf does not solve spam problems in general, its may only one from
>>> many parameters for spam tagging check
>> Indeed. I *never* subtract points for an SPF "pass" except for a very
>> few select domains that I trust. I only ever use SPF to add points in
>> the case of fail or softfail (and "neutral" for certain domains like
>> adp.com.)
> Would you suggest/recommend using spf-bayes?
> [auto-learning of "worth" of given domain SPF record]
>
i will have an eye to
http://www.ietf.org/id/draft-ietf-repute-email-identifiers-04.txt
--
Best Regards
MfG Robert Schetterer
Re: Spamassassin and SPF records with "+all" [learning per domain
worth of SPF record]
Posted by Martin Gregorie <ma...@gregorie.org>.
On Thu, 2012-07-12 at 03:20 -0400, David F. Skoll wrote:
> On Thu, 12 Jul 2012 09:08:19 +0200
> "Andrzej A. Filip" <an...@gmail.com> wrote:
>
> > Would you suggest/recommend using spf-bayes?
> > [auto-learning of "worth" of given domain SPF record]
>
> That is an interesting idea... store tokens like:
>
> example.com*spf-pass
>
> and compute probabilities.
>
There's maybe a case collecting stats in a simple table with rows keyed
on domain name and simply accumulating counts for the four levels (PASS,
NEUTRAL SOFTFAIL and FAIL) of both SPF-* and SPF-HELO-* sets along with
spam/ham counts and seeing what patterns emerge. Since nobody seems to
know how widespread SPF usage is, it might also be interesting to count
domains with no SPF flags set. Anything could be used for this: BDB,
SQLite or Derby should all do the job with minimal overheads.
Martin
Re: Spamassassin and SPF records with "+all" [learning per domain
worth of SPF record]
Posted by Benny Pedersen <me...@junc.org>.
Den 2012-07-12 09:20, David F. Skoll skrev:
> it's still the case because SPF is now more widely adopted than
> before. (Spammers tend to be early adopters of technology.)
thay are properly implementing dmarc into spamassassin right now :)
Re: Spamassassin and SPF records with "+all" [learning per domain
worth of SPF record]
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Thu, 12 Jul 2012 09:08:19 +0200
"Andrzej A. Filip" <an...@gmail.com> wrote:
> Would you suggest/recommend using spf-bayes?
> [auto-learning of "worth" of given domain SPF record]
That is an interesting idea... store tokens like:
example.com*spf-pass
and compute probabilities.
A while ago, I did an informal count of messages we had processed and
found that spammers were slightly more likely to have an SPF "pass"
than non-spammers. It wasn't a huge difference and I don't know if
it's still the case because SPF is now more widely adopted than
before. (Spammers tend to be early adopters of technology.)
Regards,
David.
Re: Spamassassin and SPF records with "+all" [learning per domain
worth of SPF record]
Posted by "Andrzej A. Filip" <an...@gmail.com>.
On 07/12/2012 09:01 AM, David F. Skoll wrote:
> On Thu, 12 Jul 2012 08:50:59 +0200
> Robert Schetterer <ro...@schetterer.org> wrote:
>
>> spf does not solve spam problems in general, its may only one from
>> many parameters for spam tagging check
> Indeed. I *never* subtract points for an SPF "pass" except for a very
> few select domains that I trust. I only ever use SPF to add points in
> the case of fail or softfail (and "neutral" for certain domains like
> adp.com.)
Would you suggest/recommend using spf-bayes?
[auto-learning of "worth" of given domain SPF record]
Re: Spamassassin and SPF records with "+all"
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Thu, 12 Jul 2012 08:50:59 +0200
Robert Schetterer <ro...@schetterer.org> wrote:
> spf does not solve spam problems in general, its may only one from
> many parameters for spam tagging check
Indeed. I *never* subtract points for an SPF "pass" except for a very
few select domains that I trust. I only ever use SPF to add points in
the case of fail or softfail (and "neutral" for certain domains like
adp.com.)
Regards,
David.
Re: Spamassassin and SPF records with "+all"
Posted by RW <rw...@googlemail.com>.
On Thu, 12 Jul 2012 08:50:59 +0200
Robert Schetterer wrote:
> Am 11.07.2012 21:34, schrieb Josef Karliak:
> > Good evening,
> > within a few days we've spams from domains that has "+all" in the
> > TXT spf record. I was thinking that I'll make a plugin that check
> > this records and add some point to this email, but I do not know
> > perl. Are there some other options ? Does anybody solve this
> > problems ? Thanks and best regards
> > J.Karliak.
> >
>
> i wouldnt invest time in it
> spf does not solve spam problems in general, its may only one from
> many parameters for spam tagging check
>
> any spammer can have valid spf records, also strict ones
> also any legal mail sender
>
> in deed many spammers have valid spf entries in dns
None of this really matters. It doesn't even matter whether
spammers get much benefit from it, as long as they do it.
What matters is whether a useful rule can be made out of spammer
behaviour. Only the numbers will tell us whether a +all rule is useful
in it's own right, and even if it isn't it may still be useful meta'ed
with other rules. It seems likely that +all is used to give valid spf
to botnet spam so maybe a meta with some botnet related rules might
be useful.
Re: Spamassassin and SPF records with "+all"
Posted by Robert Schetterer <ro...@schetterer.org>.
Am 11.07.2012 21:34, schrieb Josef Karliak:
> Good evening,
> within a few days we've spams from domains that has "+all" in the TXT
> spf record. I was thinking that I'll make a plugin that check this
> records and add some point to this email, but I do not know perl. Are
> there some other options ? Does anybody solve this problems ?
> Thanks and best regards
> J.Karliak.
>
i wouldnt invest time in it
spf does not solve spam problems in general, its may only one from many
parameters for spam tagging check
any spammer can have valid spf records, also strict ones
also any legal mail sender
in deed many spammers have valid spf entries in dns
in case of hacked accounts at big mailers like yahoo,aol etc
you have also valid dkim too, so at the end body content filtering needs
to be done however
--
Best Regards
MfG Robert Schetterer
Re: Spamassassin and SPF records with "+all"
Posted by Benny Pedersen <me...@junc.org>.
Den 2012-07-12 01:26, John Hardin skrev:
> "adding a point" is different from "listing as spammers".
yes make more meta would solve things as +all, i have not seen it as a
problem with domains that use +all here, there is more domains that
creates invalid spf, and dont want to resolve the problem, one example
domain is currently eb.dk
maybe there syslog are dev-null'ing the reject ?
Re: Spamassassin and SPF records with "+all"
Posted by John Hardin <jh...@impsec.org>.
On Thu, 12 Jul 2012, Benny Pedersen wrote:
> Den 2012-07-11 23:17, John Hardin skrev:
>
>> Adding a point for a domain that says "email from all possible IP
>> addresses is valid" may be justifiable.
>
> problem is when webhotels make default +all and hosted domains dont have
> control over there full dns, should this domain so be listed as spammers pr
> default ?
"adding a point" is different from "listing as spammers".
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Christian martyrs don't explode. -- Marisol
-----------------------------------------------------------------------
5 days until the 67th anniversary of the dawn of the Atomic Age
Re: Spamassassin and SPF records with "+all"
Posted by Benny Pedersen <me...@junc.org>.
Den 2012-07-11 23:17, John Hardin skrev:
> Adding a point for a domain that says "email from all possible IP
> addresses is valid" may be justifiable.
problem is when webhotels make default +all and hosted domains dont
have control over there full dns, should this domain so be listed as
spammers pr default ?
we have to be carefull even +all seems spammy to many, another
"problem" why are gmail using neotral pr default ?, is this spam aswell
?
> Spammers can use SPF and might
> publish a +all to cover their spambot network.
currect, but thay can not add whitelist_from_spf example.org into our
local.cf unless thay are spamassassin maintainers :=)
> I don't know whether this explains what Josef is seeing, but it's a
> possibility.
aslong there is no samples it could be :/
> Josef, do you have any feel for whether you're getting _ham_ from
> those domains as well?
if so it would be nice to know sender domain are listed in other places
Re: Spamassassin and SPF records with "+all"
Posted by John Hardin <jh...@impsec.org>.
On Wed, 11 Jul 2012, Martin Gregorie wrote:
> On Wed, 2012-07-11 at 21:34 +0200, Josef Karliak wrote:
>> within a few days we've spams from domains that has "+all" in the
>> TXT spf record.
>
> how are you proposing to improve on what SA currently does?
Adding a point for a domain that says "email from all possible IP
addresses is valid" may be justifiable. Spammers can use SPF and might
publish a +all to cover their spambot network.
I don't know whether this explains what Josef is seeing, but it's a
possibility.
Josef, do you have any feel for whether you're getting _ham_ from those
domains as well?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Sheep have only two speeds: graze and stampede. -- LTC Grossman
-----------------------------------------------------------------------
5 days until the 67th anniversary of the dawn of the Atomic Age
RE: Spamassassin and SPF records with "+all"
Posted by Benny Pedersen <me...@junc.org>.
Den 2012-07-13 19:44, Giampaolo Tomassoni skrev:
> Our hypothetic plugin could merge together CIDRs via
> Net::CIDR::Lite->add()
> and get the resultant merged, non-overlapping CIDRs via ->list(),
> then count
> the size of the allowed addresses (via something like 2^(32 -
> cidr_prefix))
> and fire rules like the ones you suggest.
so it fire if more then one ip is in spf ?, lets say more points if
more ips ?
RE: Spamassassin and SPF records with "+all"
Posted by Giampaolo Tomassoni <Gi...@Tomassoni.biz>.
> From: John Hardin [mailto:jhardin@impsec.org]
>
> Agreed. I was speculating that multiple variants of SPF_PERMISSIVE
> might be justified, e.g. SPF_PERMISSIVE_ALL, SPF_PERMISSIVE_1,
> SPF_PERMISSIVE_8, etc. However, it is only speculation; I have no
> data to support that level of complexity being useful.
Why not use Net::CIDR::Lite for this?
Our hypothetic plugin could merge together CIDRs via Net::CIDR::Lite->add()
and get the resultant merged, non-overlapping CIDRs via ->list(), then count
the size of the allowed addresses (via something like 2^(32 - cidr_prefix))
and fire rules like the ones you suggest.
Giampaolo
Re: Spamassassin and SPF records with "+all"
Posted by John Hardin <jh...@impsec.org>.
On Fri, 13 Jul 2012, Martin Gregorie wrote:
> On Fri, 2012-07-13 at 07:33 -0700, John Hardin wrote:
>>
> ---->snippage
>
>> If checking for +all is justified then checking for */1 through */8 would
>> probably also be justified, perhaps with firing different rule so that a
>> different score could be applied.
>>
> ---->more snippage
>
>> So does that mean it may be legitimate to treat an SPF PASS as "something
>> bad" if the SPF rule is defined in an "abusive" manner?
>
> I think we'd get more flexibility by calling these something like
> SPF_PERMISSIVE rather than lumping them into an existing 'bad' category,
Agreed. I was speculating that multiple variants of SPF_PERMISSIVE might
be justified, e.g. SPF_PERMISSIVE_ALL, SPF_PERMISSIVE_1, SPF_PERMISSIVE_8,
etc. However, it is only speculation; I have no data to support that
level of complexity being useful.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Liberals love sex ed because it teaches kids to be safe around their
sex organs. Conservatives love gun education because it teaches kids
to be safe around guns. However, both believe that the other's
education goals lead to dangers too terrible to contemplate.
-----------------------------------------------------------------------
3 days until the 67th anniversary of the dawn of the Atomic Age
Re: Spamassassin and SPF records with "+all"
Posted by Martin Gregorie <ma...@gregorie.org>.
On Fri, 2012-07-13 at 07:33 -0700, John Hardin wrote:
>
---->snippage
> If checking for +all is justified then checking for */1 through */8 would
> probably also be justified, perhaps with firing different rule so that a
> different score could be applied.
>
---->more snippage
> So does that mean it may be legitimate to treat an SPF PASS as "something
> bad" if the SPF rule is defined in an "abusive" manner?
>
I think we'd get more flexibility by calling these something like
SPF_PERMISSIVE rather than lumping them into an existing 'bad' category,
but it could have the same default score as SPF_FAIL and be linked to
the same standard meta-rules. This way the change wouldn't affect
default SA behaviour but, if they wish, people can still adjust its
score and/or use it as a more specific component meta-rules.
Martin
Re: Spamassassin and SPF records with "+all"
Posted by Benny Pedersen <me...@junc.org>.
Den 2012-07-13 16:33, John Hardin skrev:
> So does that mean it may be legitimate to treat an SPF PASS as
> "something bad" if the SPF rule is defined in an "abusive" manner?
meta __META_DNSWL_ANY (RCVD_IN_DNSWL_HI || RCVD_IN_DNSWL_MED ||
RCVD_IN_DNSWL_LOW)
meta META_SPF_DNSWL (__META_DNSWL_ANY && SPF_PASS)
describe META_SPF_DNSWL Meta: spf pass and listed in dnswl safe
score META_SPF_DNSWL -0.5
# optional disable autolearn bayes on this rule
feel free to test SPF_HELO_PASS aswell
i left out RCVD_IN_DNSWL_NONE this is intended here
Re: Spamassassin and SPF records with "+all"
Posted by Benny Pedersen <me...@junc.org>.
Den 2012-07-13 17:02, David F. Skoll skrev:
> Absolutely. If you do not want to receive mail from a certain
> domain and it passes SPF, then there's pretty good evidence the
> mail really *is* from that domain and that you can apply your
> domain policy.
bingo, if more recipients do this +all will change to -all soon :=)
Re: Spamassassin and SPF records with "+all"
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Fri, 13 Jul 2012 07:33:34 -0700 (PDT)
John Hardin <jh...@impsec.org> wrote:
> So does that mean it may be legitimate to treat an SPF PASS as
> "something bad" if the SPF rule is defined in an "abusive" manner?
Absolutely. If you do not want to receive mail from a certain
domain and it passes SPF, then there's pretty good evidence the
mail really *is* from that domain and that you can apply your
domain policy.
Regards,
David.
Re: Spamassassin and SPF records with "+all"
Posted by John Hardin <jh...@impsec.org>.
On Fri, 13 Jul 2012, David F. Skoll wrote:
> SPF has *never* been advocated as an anti-spam measure by the people
> who developed it.
Agreed, but that does not mean under certain circumstances it cannot be
useful as a spam indicator.
> And looking for +all or ?all is not enough; you can easily simulate
> +all with ip4:0.0.0.0/1 ip4:128.0.0.0/1 or countless other combinations.
If checking for +all is justified then checking for */1 through */8 would
probably also be justified, perhaps with firing different rule so that a
different score could be applied.
> So I think my stance will be proven correct: In general, one should
> only ever penalize domains for failing SPF. You should never treat an
> SPF "pass" as something good except for specific trusted domains.
So does that mean it may be legitimate to treat an SPF PASS as "something
bad" if the SPF rule is defined in an "abusive" manner?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Activist: Someone who gets involved.
Unregistered Lobbyist: Someone who gets involved with something
the MSM doesn't approve of. -- WizardPC
-----------------------------------------------------------------------
3 days until the 67th anniversary of the dawn of the Atomic Age
Re: Spamassassin and SPF records with "+all"
Posted by Bowie Bailey <Bo...@BUC.com>.
On 7/13/2012 4:57 AM, David F. Skoll wrote:
> On Thu, 12 Jul 2012 21:37:36 +0100
> Martin Gregorie <ma...@gregorie.org> wrote:
>
>> True enough. I just wanted to provide a concrete example of extra
>> stuff the plug-in could do and why that could be useful. It hadn't
>> occurred to me until just now that SPF_PASS can be triggered by
>> slovenly and/or careless SPF configurations as well as by careful
>> set-ups and that this fact prevents you assigning any spam-related
>> value to an SPF_PASS indication and reinforces my argument about SPF
>> being useful against backscatter and not much else.
> SPF has *never* been advocated as an anti-spam measure by the people
> who developed it.
>
> And looking for +all or ?all is not enough; you can easily simulate
> +all with ip4:0.0.0.0/1 ip4:128.0.0.0/1 or countless other combinations.
>
> So I think my stance will be proven correct: In general, one should
> only ever penalize domains for failing SPF. You should never treat an
> SPF "pass" as something good except for specific trusted domains.
An SPF pass should not be generally treated as good, but in this case,
an SPF pass on a domain with an overly-permissive SPF record could be
treated as bad. Of course, it would need to be mass-checked to make
sure it doesn't hit too many hams.
Looking for +all could be a starting place. Other patterns could be
added as they are found in spammy domains.
--
Bowie
Re: Spamassassin and SPF records with "+all"
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Thu, 12 Jul 2012 21:37:36 +0100
Martin Gregorie <ma...@gregorie.org> wrote:
> True enough. I just wanted to provide a concrete example of extra
> stuff the plug-in could do and why that could be useful. It hadn't
> occurred to me until just now that SPF_PASS can be triggered by
> slovenly and/or careless SPF configurations as well as by careful
> set-ups and that this fact prevents you assigning any spam-related
> value to an SPF_PASS indication and reinforces my argument about SPF
> being useful against backscatter and not much else.
SPF has *never* been advocated as an anti-spam measure by the people
who developed it.
And looking for +all or ?all is not enough; you can easily simulate
+all with ip4:0.0.0.0/1 ip4:128.0.0.0/1 or countless other combinations.
So I think my stance will be proven correct: In general, one should
only ever penalize domains for failing SPF. You should never treat an
SPF "pass" as something good except for specific trusted domains.
Regards,
David.
Re: Spamassassin and SPF records with "+all"
Posted by Martin Gregorie <ma...@gregorie.org>.
On Thu, 2012-07-12 at 12:17 -0700, John Hardin wrote:
> On Thu, 12 Jul 2012, Martin Gregorie wrote:
>
> > I'd suggest that any SPF record containing '+all' and possibly '?all'
> > too, should trigger an SPF_PERMISSIVE rule rather than SPF_PASS so we
> > can distinguish an authorised server in a tightly controlled domain from
> > servers claiming to be part of a domain that doesn't give a damn.
>
> ...which is pretty much where we started. :)
>
True enough. I just wanted to provide a concrete example of extra stuff
the plug-in could do and why that could be useful. It hadn't occurred to
me until just now that SPF_PASS can be triggered by slovenly and/or
careless SPF configurations as well as by careful set-ups and that this
fact prevents you assigning any spam-related value to an SPF_PASS
indication and reinforces my argument about SPF being useful against
backscatter and not much else.
Martin
Re: Spamassassin and SPF records with "+all"
Posted by John Hardin <jh...@impsec.org>.
On Thu, 12 Jul 2012, Martin Gregorie wrote:
> I'd suggest that any SPF record containing '+all' and possibly '?all'
> too, should trigger an SPF_PERMISSIVE rule rather than SPF_PASS so we
> can distinguish an authorised server in a tightly controlled domain from
> servers claiming to be part of a domain that doesn't give a damn.
...which is pretty much where we started. :)
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
End users want eye candy and the "ooo's and aaaahhh's" experience
when reading mail. To them email isn't a tool, but an entertainment
form. -- Steve Lake
-----------------------------------------------------------------------
4 days until the 67th anniversary of the dawn of the Atomic Age
Re: Spamassassin and SPF records with "+all"
Posted by Martin Gregorie <ma...@gregorie.org>.
On Thu, 2012-07-12 at 13:35 +0200, Benny Pedersen wrote:
> Den 2012-07-12 09:33, Josef Karliak skrev:
>
> > "v=spf1 +all".
>
> if i find a domain with just that i perm reject this domain in mta
> without spf testing
>
That sounds like a good idea. Can the SPF plugin recognise overly
permissive settings so they can trigger additional rules?
IOW it would be useful to be able to make a distinction between mail
from correctly listed MX servers in a domain, e.g. "v=spf1 MX -all" and
mail from a domain that is over permissive, e.g. "v=spf1 +all". My
understanding is that both of these will trigger the SPF_PASS rule,
which seems wrong.
I'd suggest that any SPF record containing '+all' and possibly '?all'
too, should trigger an SPF_PERMISSIVE rule rather than SPF_PASS so we
can distinguish an authorised server in a tightly controlled domain from
servers claiming to be part of a domain that doesn't give a damn.
Martin
Re: Spamassassin and SPF records with "+all"
Posted by Benny Pedersen <me...@junc.org>.
Den 2012-07-12 09:33, Josef Karliak skrev:
> "v=spf1 +all".
if i find a domain with just that i perm reject this domain in mta
without spf testing
> I tried "META ..." mentioned in some post, I'll see.
maybe it helps spammers ? :=)
if its your own domain as sender one could ask sender for smtp auth
password so spf is not needed there, but providing spf helps other
servers rejecting domains one self owns on other servers not just ones
own server, since i would not provide smtp auth to all world servers :=)
Re: Spamassassin and SPF records with "+all"
Posted by Josef Karliak <ka...@ajetaci.cz>.
Hi everybody,
thanks for answers.
Many of the "spamming" domains has a TXT record:
"v=spf1 +all".
Or the name record types and at the end of the record they put
"+all" anyway. So I can send spam by theirs domain, I'm authorized by
this record. That is wrong. Ok, not everyone uses only dedicated
servers for sending emails - in that case we may agree with softfail
(~all) or neutral (?all). But not every email (+all), grrr :).
I don't want reject emails from +spf domains, only add a few
points, but only to the emails with "+all"
I tried "META ..." mentioned in some post, I'll see.
Thanks
J.K.
Cituji Martin Gregorie <ma...@gregorie.org>:
> On Wed, 2012-07-11 at 21:34 +0200, Josef Karliak wrote:
>> Good evening,
>> within a few days we've spams from domains that has "+all" in the
>> TXT spf record.
>>
> All SPF can do is check that the sender has a valid IP for that domain,
> i.e. that the sender's domain wasn't forged. SPF cannot and should not
> be used to flag mail as spam if the sender is a legitimate member of the
> source domain. This is regardless of whether you think the mail as spam
> or ham.
>
> FWIW I think SPF's main use is in avoiding backscatter, e.g. if a
> spammer forged your address as sender and his target domain is bouncing
> rejected mail back to you. It does this well, but I don't think its of
> any use at all for detecting spam other than possibly adding a few
> points for an SPF-FAIL. However, as SPF records aren't necessarily
> correct (they may never have been tested properly or possibly were not
> updated with MX changes) how are you proposing to improve on what SA
> currently does?
>
>
> Martin
>
>
>
--
Ma domena pouziva zabezpeceni a kontrolu SPF (www.openspf.org) a
DomainKeys/DKIM (with ADSP) . Pokud mate problemy s dorucenim emailu,
zacnete pouzivat metody overeni puvody emailu zminene vyse. Dekuji.
My domain use SPF (www.openspf.org) and DomainKeys/DKIM (with ADSP)
policy and check. If you've problem with sending emails to me, start
using email origin methods mentioned above. Thank you.
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
Re: Spamassassin and SPF records with "+all"
Posted by Daniel McDonald <da...@austinenergy.com>.
On 7/11/12 3:45 PM, "Martin Gregorie" <ma...@gregorie.org> wrote:
> On Wed, 2012-07-11 at 21:34 +0200, Josef Karliak wrote:
>> Good evening,
>> within a few days we've spams from domains that has "+all" in the
>> TXT spf record.
>>
> All SPF can do is check that the sender has a valid IP for that domain,
> i.e. that the sender's domain wasn't forged. SPF cannot and should not
> be used to flag mail as spam if the sender is a legitimate member of the
> source domain. This is regardless of whether you think the mail as spam
> or ham.
>
> FWIW I think SPF's main use is in avoiding backscatter,
I think the main use is to whitelist those correspondents who use it
correctly. We've placed that in our bid documents - in order to win
business with us, you have to use either DKIM or SPF to validate your e-mail
conversations with us, and I will either create a whitelist_from_spf or
whitelist_from_dkim line for that domain.
I also specify in the bid documents that the use of +ALL and ~ALL is not
permitted. If you are going to send us mail and have a whitelist entry, I
want to know that you know where your mail is coming from.
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281
Re: Spamassassin and SPF records with "+all"
Posted by Martin Gregorie <ma...@gregorie.org>.
On Wed, 2012-07-11 at 21:34 +0200, Josef Karliak wrote:
> Good evening,
> within a few days we've spams from domains that has "+all" in the
> TXT spf record.
>
All SPF can do is check that the sender has a valid IP for that domain,
i.e. that the sender's domain wasn't forged. SPF cannot and should not
be used to flag mail as spam if the sender is a legitimate member of the
source domain. This is regardless of whether you think the mail as spam
or ham.
FWIW I think SPF's main use is in avoiding backscatter, e.g. if a
spammer forged your address as sender and his target domain is bouncing
rejected mail back to you. It does this well, but I don't think its of
any use at all for detecting spam other than possibly adding a few
points for an SPF-FAIL. However, as SPF records aren't necessarily
correct (they may never have been tested properly or possibly were not
updated with MX changes) how are you proposing to improve on what SA
currently does?
Martin
Re: Spamassassin and SPF records with "+all"
Posted by Xtrade Assessory <xt...@matik.com.br>.
Em Wed, 11 Jul 2012 18:22:49 -0400
darxus@chaosreigns.com escreveu:
> On 07/11, Josef Karliak wrote:
> > within a few days we've spams from domains that has "+all" in the
> > TXT spf record. I was thinking that I'll make a plugin that check
> > this records and add some point to this email, but I do not know
>
> Your best chance may be to open a spamassassin bug requesting it. I'd
> guess it wouldn't be too hard to add to the existing SPF plugin. The
> more information you can provide showing this happens with spam, and
> does not tend to happen with non-spam, the better. It would get run
> through the re-scoring process with a testing flag to determine if
> it's actually useful, and what the optimal score is, before being
> published via sa-update. Well, you'd also need to update your SPF
> plugin to be able to use it....
>
> "v=spf1 +all"
> The domain owner thinks that SPF is useless and/or doesn't care.
> - http://www.openspf.org/SPF_Record_Syntax
>
> That's a *really* unprofessional way to say "Everything in this domain
> passes SPF."
>
>
right, or better, this domain is using spf only for having it, means
nothing ...
IMO any of this spf politic options + ? ~ are making the SPF record
worthless
but I think the -all option should be considered as valid, because at
least the sys-admin gives instruction to reject what is not defined by
his SPF record. So it should be treated by the receiver MTA as it is
meant.
Hans
--
XTrade Assessory
International Facilitator
BR - US - CA - DE - GB - RU - UK
+55 (11) 4249.2222
http://xtrade.matik.com.br