Spf Confusion

[charlie]

Hi,

I just had my first email bouce caused by SPF (about which I know nothing!). All my email goes through HostPC. Is there anything I can do to fix this? I've pasted some info below, I've replaced some numbers/names with x's:

Charlie

Firstly, dnsreport.com tells me that:
------------------------------------------
You have an SPF record. This is very good, as it will help prevent spammers from abusing your domain. Your SPF record is:
"v=spf1 -all" [TTL=14400]
-------------------------------------------

Anyway, here's the bounce headers:
-------------------------------------------------
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

* xxx@digiguide.com
* * SMTP error from remote mailer after MAIL FROM:<charlie@charliejoy.com>*SIZE=1927:
* * host mail.gipsymedia.com [81.6.234.71]: 550 199.237.51.29 does not pass SPF requirements for domain charlie@charliejoy.com

------ This is a copy of the message, including all the headers. ------

Return-path: <charlie@charliejoy.com>
Received: from [68.56.136.xxx] (helo=gateway-laptop)
* * * * by www17.hostpc.com with asmtp (Exim 4.24)
* * * * id 1CX4JS-0007Wz-T0
* * * * for xxx@digiguide.com; Wed, 24 Nov 2004 16:04:31 -0500
From: * * Charlie Joy <charlie@charliejoy.com>
To: * * * *<xxx@digiguide.com>
X-Mailer: PocoMail 3.2 (2004) - Licensed Version
Date: Wed, 24 Nov 2004 16:04:29 -0500
Message-ID: <2004112416429.865138@gateway-laptop>
Subject: xxx
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
--------------------------------------------------------------------

Now running the test at spf.pobox.com tells me:

---------------------------------------------------------------------

An email system which uses SPF rejected a message claiming to be from charliejoy.com.
An email system which uses SPF saw a message coming from the IP address 68.56.136.xxx which is pcp856xxxpcs.palmrn01.fl.comcast.net; the sender claimed to be charliejoy.com.

However, charliejoy.com has announced using SPF that it does not send mail out through 68.56.136.xxx. That is why the mail was rejected.

If you are charliejoy.com:
charliejoy.com should have given you a way to send mail through an approved server.

If you are using a mail program instead of webmail, you may need to update the SMTP server configuration setting according to your ISP's instructions. You may also need to turn on authentication, and enter your username and password in your mail program's "Preferences".

If you run your own MTA, you may need to set a smarthost or relayhost. If you are mailing from outside your ISP's network, you may also need to make your MTA authenticate SMTP using SASL. Ideally your server should listen on port 587 as well as port 25.

You can also try emailing your recipient at an alternative email address.

Please contact your ISP for further assistance; ask them for help in configuring outbound SMTP email.

If your company needs further help, we provide a full range of consulting services to help you resolve these problems quickly.

If you are confident your mail did go through an approved server:
The system administrator for charliejoy.com may have incorrectly configured its SPF record. This is a common cause of mistakes.

Here's what you can do. Contact the system administrator responsible for charliejoy.com and tell them that they need to change its SPF record so that it contains pcp856xxxpcs.palmrn01.fl.comcast.net. For example, they could change the record to something like

v=spf1 a:pcp856xxxpcs.palmrn01.fl.comcast.net -all
If you can show this web page to your system administrator, they should be able to solve the problem.

If you did not send the message:
SPF successfully blocked a forgery attempt; someone tried to send mail pretending to be from you, but the message was rejected before anybody saw it. If you received a bounce message, you can delete it. This means SPF is working as designed.

[Jeff]

SPF is fraught with problems and we'd all be better off if it hadn't been implemented just yet. This forum post will help you understand what SPF is, how HostPC can help you cope with it and why it may be better to do nothing at all!

http://www.hostpc.com/forums/index.php?showtopic=1539

[charlie]

Hi Jeff,

no idea how I missed the post you just pointed me to.... Thanks a lot for that, an interesting read, and I think I will leave well alone unless the problem gets a lot worse...

Thanks,

Charie

[charlie]

OK, I have one query about the SPF file....

AIUI the spf file for my domain is: "v=spf1 -all" [TTL=14400]


Now, according to spf.pobox.com:

----------------------------------------
v=spf1 means This identifies the TXT record as an SPF string.

-all means No servers are allowed to send mail from charliejoy.com.
This is appropriate for web-only sites.
-------------------------------------------

So it seems to me (and I may well be wrong) that the default SPF file will NEVER allow ANY mail I send from my domain to be authenticated by SPF ever...?

I can see that this is good in that spammers cannot pretend to send mail from my domain. But it is bad in that I cannot have any of my mail authenticated by SPF.

Have I understood this correctly?

Charlie

[Joe]

Yes, it should be ~all

Open a ticket, we'll correct it

[charlie]

Thanks Joe, I have opened a ticket,

Charlie

[Joe]

I've found another way to do this, that you can actually do yourself.

Log into your control panel, click on DNS management.

You'll see a bunch of records there. Be VERY careful not to touch anything there - one mistake can take your site completely offline. If you're uncomfortable with this, open a ticket, and we'll do it for you.

You'll see things like

Name Type Value
mail A 199.x.x.x

That's an "A" record. you need to create an "A" record for 'test' - with the server ip numbers you see under "value"

so, scroll down, in the "Add Domain Records" field, put in

test then hit TAB - and put in the IP address you see above in your list (different for every server)

and click the ADD button next to it.

You'll then see your list on top like this:

Name Type Value
mail A 199.x.x.x
test A 199.x.x.x

Last step - very important: put a checkmark in the box next to test - and click DELETE SELECTED. Yes, you're going to delete the same record you just created. ONLY click ONE box - next to TEST... if you delete others, there's gonna be problems.

This procedure will cause your DNS files to be updated to the latest configuration known to work:

domain.com. IN TXT "v=spf1 a mx ip4:199.237.51.29 ~all"

obviously, the IP address will be different depending on your server.


Hope that helps.

Joe

[Joe]

Originally posted by charlie@Nov 25 2004, 08:40 AM
Thanks Joe, I have opened a ticket,

Charlie
Quoted post



You're all set Charlie - I've corrected your entries

Joe

[charlie]

Hi Joe,

I'd just likie to say publicly that I'm truly impressed with your support. 17 minutes after I opened a ticket asking for the SPF change, at 8:30 on Thanksgiving morning, it was done....

Charlie :-)

[Joe]

heh :)

Actually it was 9:30 ET - I'd already been here for 4 hours :)

thanks - glad to have happy clients!

Joe

[NHFTRich]

Originally posted by Joe@Nov 25 2004, 09:08 AM
I've found another way to do this, that you can actually do yourself.

Log into your control panel, click on DNS management.

You'll see a bunch of records there. Be VERY careful not to touch anything there - one mistake can take your site completely offline. If you're uncomfortable with this, open a ticket, and we'll do it for you.

You'll see things like

Name Type Value
mail A 199.x.x.x

That's an "A" record. you need to create an "A" record for 'test' - with the server ip numbers you see under "value"

so, scroll down, in the "Add Domain Records" field, put in

test then hit TAB - and put in the IP address you see above in your list (different for every server)

and click the ADD button next to it.

You'll then see your list on top like this:

Name Type Value
mail A 199.x.x.x
test A 199.x.x.x

Last step - very important: put a checkmark in the box next to test - and click DELETE SELECTED. Yes, you're going to delete the same record you just created. ONLY click ONE box - next to TEST... if you delete others, there's gonna be problems.

This procedure will cause your DNS files to be updated to the latest configuration known to work:

domain.com. IN TXT "v=spf1 a mx ip4:199.237.51.29 ~all"

obviously, the IP address will be different depending on your server.


Hope that helps.

Joe
Quoted post



Joe this procedure seemed to work for me. I applied it to each of my servers and now I think my email is going out again, thanks!

[D9r]

These might be helpful:
http://www.dnsreport.com/ - helps you get IPs and other cool stuff
http://www.openspf.org/ - has a wizard for creating new SPF records

[Using SPF to prevent spoofing?]

Originally posted by D9r@Nov 26 2005, 05:48 PM
These might be helpful:
http://www.dnsreport.com/ - helps you get IPs and other cool stuff
http://www.openspf.org/ - has a wizard for creating new SPF records
Quoted post


I'm wondering if a more specific implementation of SPF could prevent spoofing? A couple of my domains are *very* prone to be hit with spoofed outgoing spam. Could an SPF setting of something other than "all" work towards preventing this? Perhaps by adding in the specific domains that my email tends to go out from?

Feedback and comments welcome,

Dave.