This is informational, as a lot of you seem to be using poorly
configured mail servers without knowing it.

There are 2 main errors:

1. Allowing IP addresses reserved for private networks onto the net,
e.g.

Received: from [192.168.1.45] (pool-71-103-104-29.lsanca.dsl-w.verizon.net    
[71.103.104.29])  by hops.lfs-matrix.net

192.168.xxx.xxx doesn't resolve to anything. For those with spam 
filters, this triggers various rules, usually UNPARSEABLE_RELAY, an
excellent spam indicator.

2. Jumbled domains, triggering the FORGED_RCVD_HELO rule

Received: from p54A52B17.dip0.t-ipconnect.de (EHLO Trollhammer) [84.165.
43.23]

trollhammer.com is 70.96.0.0 - 70.103.255.255.

This mail to the list ended up in spam (It triggered both of the above)
Received: from fiancee (unknown [81.106.244.9])
        by smtp14 (Coremail) with SMTP id GQBiG7f6dENq1UsC.1

fiancee.com is 199.79.199.69 but we are coming from NTL in Wales (?)
The day NTL gets spam half sorted, their mail throughput will drop by
90%


The fix is 



For broadband & dialup users like myself who relay their mail through
their isp, set up as follows in postfix or the equivelant in other mail
servers. In /etc/postfix/main.cf:

myhostname = <The bit of your email address before the @> junk_mail
myorigin = <The bit after the @> iol.ie
append_at_myorigin = yes
append_dot_mydomain = no

Postfix then assembles 'junk_mail', '@' & 'iol.ie' into an address which
just happens to be my email. The box has a different hostname and
domain, and everything gets along well. Here's a mail to gmail (who are tough 
on spam)

Received-SPF: pass (gmail.com: best guess record for domain of
[EMAIL PROTECTED] designates 193.120.142.151 as permitted sender)
Received: from [194.125.97.37] (helo=junk_mail)
        by mail1.mail.iol.ie with esmtp (Exim 3.36 #9)
                id 1Ebig3-0005MM-00
                
SPF = is sender policy framework. It wasn't a bad guess either, as that 
193.120.142.151 is  mail1.mail.iol.ie. It somehow extracted 'genius' (my
original hostname) but I don't know enough about SPF to say how or why.

194.125.97.37 is with esat.net, but then esat bought iol.ie and were in
turn gobbled by BTIreland so it all gets complicated and they use
whatever domain they like.


-- 

        With best Regards,


        Declan Moriarty.
-- 
http://linuxfromscratch.org/mailman/listinfo/blfs-support
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

Reply via email to