[LINK] RFI: Spam-registration of IP-addresses

[Roger Clarke]

Many thanks to the several people who pointed me to the SPF entry!

Chris Maltby's explanation (all-but) nailed the problem.

Changing the SPF entry to ip4:103.27.32.0/24 fixed Yahoo.
But my Rocketmail mate still gets my messages thrown into Junk.

VentraIP responded, and recommended a different SPF entry:
v=spf1 +a +mx +include:spf.hostingplatform.net.au ~all

That also appears to work for Yahoo, but also not for Rocketmail.

I've looked into DMARC and inserted:
TXT  v=DMARC1; p=none; rua=roger.clarke at xamax.com.au

That ought to generate a rejection-message that might help with
debugging;  but it hasn't so far.

I was vaguely been aware of SPF and DMARC but had never looked at them.

Only 0.1% of my correspondents use Rocketmail, and he's said he also
found a telco invoice in his Junk-folder this morning ...

Thanks Chris and others!

_______________

WAS:
TXT  v=spf1 ip4:103.27.32.5 +include:retailspf.smtp.com ?all

CHANGED TO:
TXT  v=spf1 ip4:103.27.32.0/24 +mx +a ~all

The old one says to trust email that comes from a specific IP-address.
The new one says to trust it if it comes from a range of IP-addresses.

The SMTP-server operator has big volumes, and uses multiple addresses.

CHANGED AGAIN TO:
v=spf1 +a +mx +include:spf.hostingplatform.net.au ~all

Both new entries *ought* to leave no clues for Rocketmail's Artificial
Stupidity to trip over - although the first works only if ISP's
wholesale provider stays within that range of IP-addresses.  Networked
business topologies are *so* much more efficient, right??

_______________________

On 22/11/20 1:12 pm, Chris Maltby wrote:
> I'm not sure that your xamax.com.au SPF details are good.
> 
> xamax.com.au: "v=spf1 *ip4:103.27.32.5* +include:retailspf.smtp.com ?all"
> retailspf.smtp.com: "v=spf1 ip4:192.40.160.0/19 ip4:74.91.80.0/20 ~all"
> 
> but the sending address at syd.hostingplatform.net.au is 103.27.32.232.
> You could try changing the ip4:103.27.32.5 to ip4:103.27.32.0/24.
> 
> You might also want to set up a DMARC record so that you can receive
> reports of messages that fail SPF/DKIM/ARC checks.
> 
> Yahoo is one of the fussiest, but also seems to permit the most real spam...
> 
> Chris
> 
> On 21/11/2020 7:14 am, Roger Clarke wrote:
>> If anyone can point me to relevant sources to help me understand and
>> address the following problem, I'd be very appreciative!

_______________________

Roger Clarke                            mailto:Roger.Clarke at xamax.com.au
T: +61 2 6288 6916   http://www.xamax.com.au  http://www.rogerclarke.com

Xamax Consultancy Pty Ltd      78 Sidaway St, Chapman ACT 2611 AUSTRALIA

Visiting Professor in the Faculty of Law            University of N.S.W.
Visiting Professor in Computer Science    Australian National University