I would like to see the Spam logs for these transactions as well. This
is where thw SPF check is logged
Eric S
Tom Pepper wrote:
We are using Imail 8.20 HF 2, with SPF enabled, and appropriate SPF records
in both our external and internal DNS servers.
Our external IP is 216.180.13.2, internal is 192.168.1.2 and we are set up
for "No Mail Relay", authentication is required for all users.
SPF has been working flawlessly. However, on 6-21-05, two emails got
through the SPF. No others did throughout any other part of the day.
I have included server logs and headers of the message. The from email
address of egmtomjr is bogus, there is a tomjr in the system.
Could you please speculate as to what might have caused this mail to bypass
the SPF? Thanks!
Tom
-------------------------------------------
Received: from ATHLON2200 [201.254.155.114] by ntserve.sharpcom.com
(SMTPD-8.20) id A172028C; Tue, 21 Jun 2005 17:15:14 -0500
Received: from 213.78.200.57
(SquirrelMail authenticated user [EMAIL PROTECTED]);
by 216.180.13.2 with HTTP;
Tue, 21 Jun 2005 18:12:24 -0500
Message-Id: <cellar is transpiration alexander a detail not decaffeinate
[EMAIL PROTECTED]>
Date: Tue, 21 Jun 2005 18:12:24 -0500
Subject: Top Notch New Homes for the USA!
From: "Krista Pitts" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
User-Agent: SquirrelMail/1.4.3a
X-Mailer: SquirrelMail/1.4.3a
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 7Bit
X-Priority: 3 (Normal)
Importance: Normal
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 417035540
X-IMail-ThreadID: 916d018b00000359
20050621 171509 127.0.0.1 SMTPD (916d018b00000359) [192.168.1.2]
connect 201.254.155.114 port 4941
20050621 171511 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
HELO ATHLON2200
20050621 171514 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
MAIL FROM: <[EMAIL PROTECTED]>
20050621 171516 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171520 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171520 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
ERR ntserve.sharpcom.com invalid user <[EMAIL PROTECTED]
20050621 171524 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171527 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171528 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171531 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171539 127.0.0.1 SMTPD (916d018b00000359) [201.254.155.114]
D:\IMail\spool\D916d018b00000359.SMD 1191
20050621 171539 127.0.0.1 SMTPD (916d018b00000359) performing antispam
checks
20050621 171540 127.0.0.1 SMTP (916d018b00000359) processing
D:\IMail\spool\Q916d018b00000359.SMD
20050621 171540 127.0.0.1 SMTP (916d018b00000359) ldeliver
ntserve.sharpcom.com allen-main (1) [EMAIL PROTECTED] 1191
20050621 171540 127.0.0.1 SMTP (916d018b00000359) ldeliver
ntserve.sharpcom.com dsadler-main (1) [EMAIL PROTECTED] 1191
20050621 171540 127.0.0.1 SMTP (918c000005c003c8) processing
D:\IMail\spool\Q918c000005c003c8.FWD
20050621 171540 127.0.0.1 SMTP (918c000005c003c8) requeuing
D:\IMail\spool\Q918c000005c003c8.FWD R0 T1
20050621 171540 127.0.0.1 SMTP (918c000005c003c8) finished
D:\IMail\spool\Q918c000005c003c8.FWD status=3
20050621 171540 127.0.0.1 SMTP (916d018b00000359) forwarded message to
[EMAIL PROTECTED] using new file: 918c000005c003c8
20050621 171540 127.0.0.1 SMTP (916d018b00000359) ldeliver
ntserve.sharpcom.com frank-main (1) [EMAIL PROTECTED] 1191
20050621 171540 127.0.0.1 SMTP (916d018b00000359) ldeliver
ntserve.sharpcom.com tomjr-main (1) [EMAIL PROTECTED] 1191
20050621 171540 127.0.0.1 SMTP (916d018b00000359) ldeliver
ntserve.sharpcom.com tomp-main (1) [EMAIL PROTECTED] 1191
20050621 171540 127.0.0.1 SMTP (916d018b00000359) finished
D:\IMail\spool\Q916d018b00000359.SMD status=1
-----------------------------------
Received: from adsl-213-78-200-57.oneteldsl.net [213.78.200.57] by
ntserve.sharpcom.com
(SMTPD-8.20) id A0CE02BC; Tue, 21 Jun 2005 17:12:30 -0500
Received: from 213.78.200.57
(SquirrelMail authenticated user [EMAIL PROTECTED]);
by 216.180.13.2 with HTTP;
Tue, 21 Jun 2005 18:12:24 -0500
Message-Id: <cellar is transpiration alexander a detail not decaffeinate
[EMAIL PROTECTED]>
Date: Tue, 21 Jun 2005 18:12:24 -0500
Subject: Top Notch New Homes for the USA!
From: "Krista Pitts" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
User-Agent: SquirrelMail/1.4.3a
X-Mailer: SquirrelMail/1.4.3a
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 7Bit
X-Priority: 3 (Normal)
Importance: Normal
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 417035539
X-IMail-ThreadID: 90cb017e00000353
20050621 171228 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57]
HELO adsl-213-78-200-57.oneteldsl.net
20050621 171230 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57]
MAIL FROM: <[EMAIL PROTECTED]>
20050621 171231 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171233 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171233 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57] ERR
ntserve.sharpcom.com invalid user <[EMAIL PROTECTED]
20050621 171234 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171236 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171237 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171238 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57]
RCPT TO: <[EMAIL PROTECTED]>
20050621 171244 127.0.0.1 SMTPD (90cb017e00000353) [213.78.200.57]
D:\IMail\spool\D90cb017e00000353.SMD 1211
20050621 171414 127.0.0.1 SMTP (90cb017e00000353) processing
D:\IMail\spool\Q90cb017e00000353.SMD
20050621 171414 127.0.0.1 SMTP (90cb017e00000353) ldeliver
ntserve.sharpcom.com allen-main (1) [EMAIL PROTECTED] 1211
20050621 171414 127.0.0.1 SMTP (90cb017e00000353) ldeliver
ntserve.sharpcom.com dsadler-main (1) [EMAIL PROTECTED] 1211
20050621 171414 127.0.0.1 SMTP (90cb017e00000353) forwarded message to
[EMAIL PROTECTED] using new file: 9136000005c0b53f
20050621 171414 127.0.0.1 SMTP (9136000005c0b53f) processing
D:\IMail\spool\Q9136000005c0b53f.FWD
20050621 171414 127.0.0.1 SMTP (9136000005c0b53f) Trying mybeep.net
(0)
20050621 171414 127.0.0.1 SMTP (90cb017e00000353) ldeliver
ntserve.sharpcom.com frank-main (1) [EMAIL PROTECTED] 1211
20050621 171414 127.0.0.1 SMTP (90cb017e00000353) ldeliver
ntserve.sharpcom.com tomjr-main (1) [EMAIL PROTECTED] 1211
20050621 171414 127.0.0.1 SMTP (90cb017e00000353) ldeliver
ntserve.sharpcom.com tomp-main (1) [EMAIL PROTECTED] 1211
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
