E-Mail Spoofing?

[capnqwest]

I normally use Gmail for all of my correspondance but had set up an account on one of my domains. On a whim I decided to check the address and found tens of thousands of sender failures. An hour later, I got a call from one of my clients who told me he'd been getting some spam complaints. I don't have any open relays but I'm not an e-mail security expert. My main worry is getting my server banned as a spam machine. I assume that the e-mail addresses are spoofed but my machine's IP is fine. Does anyone have any experience with this?

[charles]

Send the full headers to support and they can tell you if it's spoofed or not.

If it's not spoofed they should be able to tell you how it's happening as stop it.

If anything gets blocked, its the whole subnet, so we take this very seriously. Please submit a ticket ASAP.

charles

[capnqwest]

Will do Charles. The client who called me said she didn't have a single e-mail set up on that account.

[smoore]

Also check your IP on the spam blacklists periodically, using something like http://rbls.org or http://www.dnsstuff.com.

[capnqwest]

Also check your IP on the spam blacklists periodically, using something like http://rbls.org or http://www.dnsstuff.com.

Yeah, my IP isn't there....

[smoore]

My IP is clean except for the blars.org blacklist dnsstuff checks against. It was on that one from day one so wasn't anything I did, and he blocks entire netblocks. But from what I can see, the Blars list is not widely used, and just an attempt at extortion.

[charles]

Blars is a joke

They all block entire netblocks, so you better believe were doing everything we can to keep them clear.

charles

[ndndixie]

AOL is becoming my nightmare! I thought I had it settled when I applied for the whitelist, which they approved, but still have 500 messages setting in queue that AOL/CS won't accept. From what I'm learning, it's not uncommon for AOL to just randomly block entire IP blocks. No rhyme or reason, just because they are AOL.

[sewmyheadon]

Make sure to enable Reverse DNS on your server(s) or AOL (and some other providers) won't accept the messages. They employ reverse-DNS checking to fight spam.

[smoore]

I'm having no problem with AOL delivery, also went through the whitelist process successfully. I do have reverse DNS setup, I also hear they absolutely require it. It also may help to ensure you have a valid SPF record in DNS.

[ndndixie]

They are now and a handful went thru a few minutes ago but I am ready to go postal if I receive another form mail, written by some clerk in India that is quoting from a script! "Please have the postmaster of the domain contact us." I have told them 90000000000000 times that I AM the "postmaster" and I need to talk to someone with enough brains to understand what I'm telling them.

[vps-vince]

I see all DNS zones have an spf entry:

"v=spf1 a mx ptr"

What is the difference, pros/cons to the following:

"v=spf1 a mx ptr ?all"

Thanks,

- V

[ndndixie]

UGH! I just got an email from my own domain with some kind of zip file attached. (Of course I didn't open it) Help?

[Tony]

submit a support ticket; and forward the e-mail to us, including the full headers. One of our techs will check it out for you. =)

[ndndixie]

Will do! Love this fast service.........(Charles told me to stop pushing buttons lol)

[Tony]

lol.

We do try =)

[ndndixie]

Why y'all are just darlin's. I just sent the headers but y'all can log into my e mail iffen ya want and see it that way..........lol nothing special in that account, I keep all my love letters in a seperate one.

[Tony]

damn, that account must have a gig quota! =P

[ndndixie]

Lol, yeah but that's to cover the rejections.

[Tony]

awww =/ surely not?

random-text-here-to-exceed-minimum-char-limit

[vps-vince]

I feel rejected right now :o

I see all DNS zones have an spf entry:

"v=spf1 a mx ptr"

What is the difference, pros/cons to the following:

"v=spf1 a mx ptr ?all"

[Tony]

The exact answer to that question is:

"all - The all type terminates processing (but may be optionally followed by a mod value). It is defined to be optional but it is a Good Thing™ to include it. It is normally present in the form -all to signify that if processing reaches this point without a prior match the result will be fail. But if you are not sure that the tests are conclusive you could use ?all which would allow mail to be accepted even if all previous checks failed."

Courtesy google (http://www.google.com/search?hl=en&lr=&biw=1014&q=spf+howto&***G=Search) & http://www.zytrax.com/books/dns/ch9/spf.html ;-)

[smoore]

Also, you can validate your SPF at http://www.dnsstuff.com/pages/spf.htm