Re: [mailop] Spammers mining SPF records (of all things)

2017-03-13 Thread Carl Byington
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Sat, 2017-03-11 at 19:19 -0500, Rich Kulawiec wrote: > I'm not saying they're not doing it: of course they are. I've done > some manipulation of WHOIS and DNS records in order to track it, so > I've got proof in hand. I'm sure others do as well.

Re: [mailop] Spammers mining SPF records (of all things)

2017-03-11 Thread Dave Warren
On Sat, Mar 11, 2017, at 16:19, Rich Kulawiec wrote: > On Sat, Mar 11, 2017 at 10:52:21AM +0800, ComKal Networks wrote: > > I have noticed the scrapping of whois and dns records > > appears to have increased dramatically over the past > > 2 years. > > Both of those are poor sources of email addres

Re: [mailop] Spammers mining SPF records (of all things)

2017-03-11 Thread Rich Kulawiec
On Sat, Mar 11, 2017 at 10:52:21AM +0800, ComKal Networks wrote: > I have noticed the scrapping of whois and dns records > appears to have increased dramatically over the past > 2 years. Both of those are poor sources of email addresses, though: the duplication across many domains and the frequent

Re: [mailop] Spammers mining SPF records (of all things)

2017-03-10 Thread ComKal Networks
Hi Philip, > Obviously I don't allow relaying without authentication but I hadn't > realised spammers were now harvesting SPF records. > Anyone else noticed this? I have noticed the scrapping of whois and dns records appears to have increased dramatically over the past 2 years. Often when sel

[mailop] Spammers mining SPF records (of all things)

2017-03-10 Thread Philip Paeps
I wonder if anyone else has noticed this. I have a mailserver listed as a sender in the SPF records for a bunch of domains. It only sends mail, it's not listed in any MX records. A couple of days after adding this machine to SPF records, I'm seeing many attempts in my maillogs from spammers tryi