hmdmhdfmhdjmzdtjmzdtzktdkztdjz at gmail
Aug 2, 2008, 12:10 PM
Post #3 of 3
(334 views)
Permalink
|
Kenn Roberts wrote:
> We are unable to find the error that is causing this problem.
There's a test address somewhere, you send mail to it, it tells
you what the receiver sees. Your message to this list contains
the following Received header field:
| Received: from theibn.com (unknown [67.116.23.194]) by
| chiclet.listbox.com (Postfix) with ESMTP id 434A022B79A for
| <spf-help[at]v2.listbox.com>; Sat, 2 Aug 2008 13:07:58 -0400 (EDT)
You'd need a policy permitting IP 67.116.23.194 (among others).
> ibn2.com. IN TXT "v=spf1 ip4:67.116.23.194
> ip4:67.116.20.66 ip4:69.3.29.34 -all"
This does the trick for mail from user[at]ibn2.com
> mail.ibn2.com. IN TXT "v=spf1 ip4:67.116.23.194
> ip4:67.116.20.66 ip4:69.3.29.34 -all"
Ditto for mail from user[at]mail.ibn2.com (if that's relevant)
> mail.ibn2.com. IN TXT "v=spf1 ip4:67.116.23.210
> ip4:67.116.20.70 ip4:69.3.27.37 -all"
That would give you a PermError, you cannot have two different
policies for the same domain. Join the two TXT records in one,
join the two SPF records in one. Use Scott's SPF validator to
check the effect.
> The mailserver is on a private network 192.168.20.4
That's irrelevant, as discussed some days ago, only your public
IPs count.
> multi-honed public network addresses 67.116.23.194
> 67.116.20.66 and 69.3.29.34.
Yes, those IPs are permitted to send mail from user[at]ibn2.com,
so this can't be your problem.
Don't forget that changes in your policy won't immediately work
for receivers with an older policy in their DNS cache. I'd use
~all (SOFTFAIL) instead of -all (FAIL) until I'm sure about the
effect, YMMV, it also depends on your ibn2.com use cases.
> The domain has the following A records;
> ;
> mail.ibn2.com. IN A 69.3.27.37
> mail.ibn2.com. IN A 67.116.20.70
> mail.ibn2.com. IN A 67.116.23.210
That simplifies the fix for mail.ibn2.com (see above): Just add
an "a" to the first record to cover these three IPs, and delete
the second record (for both sets, TXT and SPF), example:
- mail.ibn2.com. IN SPF "v=spf1 ip4:67.116.23.194
- ip4:67.116.20.66 ip4:69.3.29.34 -all"
- mail.ibn2.com. IN SPF "v=spf1 ip4:67.116.23.210
- ip4:67.116.20.70 ip4:69.3.27.37 -all"
+ mail.ibn2.com. IN SPF "v=spf1 ip4:67.116.23.194
+ ip4:67.116.20.66 ip4:69.3.29.34 a -all"
...................................^
> The MX records point to a spam appliance cuda-1.theibn.com
> 67.116.23.204, 67.116.20.76 and 69.3.29.41 and cuda-2.ibnto.com
> 67.116.23.205, 67.116.20.77 and 69.3.29.42.
As long as those MXs don't *send* mail from user[at]ibn2.com they
are irrelevant. I wonder why you permit six IPs for mail.ibn2,
but only three IPs for ibn2, and what MAIL FROM adresses we are
talking about, user[at]ibn2, user[at]mail.ibn2, or both ?
If both, why are the sender policies different ? Is it possible
that you forgot the three a:mail.ibn2.com in the ibn2.com policy ?
Frank
-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com
|
