[LINK] RFI: Spam-registration of IP-addresses

[Kim Holburn]

Thanks to Chris Maltby for the heads up about DMARC.  I am trying it out.  Unfortunately I'm pretty sure DKIM requires one to own 
one's own SMTP server.

On 2020/11/24 11:57 am, Roger Clarke wrote:
> Many thanks to the several people who pointed me to the SPF entry!
> 
> Chris Maltby's explanation (all-but) nailed the problem.
> 
> Changing the SPF entry to ip4:103.27.32.0/24 fixed Yahoo.
> But my Rocketmail mate still gets my messages thrown into Junk.
> 
> VentraIP responded, and recommended a different SPF entry:
> v=spf1 +a +mx +include:spf.hostingplatform.net.au ~all
> 
> That also appears to work for Yahoo, but also not for Rocketmail.
> 
> I've looked into DMARC and inserted:
> TXT  v=DMARC1; p=none; rua=roger.clarke at xamax.com.au
> 
> That ought to generate a rejection-message that might help with
> debugging;  but it hasn't so far.
> 
> I was vaguely been aware of SPF and DMARC but had never looked at them.
> 
> Only 0.1% of my correspondents use Rocketmail, and he's said he also
> found a telco invoice in his Junk-folder this morning ...
> 
> Thanks Chris and others!
> 
> _______________
> 
> WAS:
> TXT  v=spf1 ip4:103.27.32.5 +include:retailspf.smtp.com ?all
> 
> CHANGED TO:
> TXT  v=spf1 ip4:103.27.32.0/24 +mx +a ~all
> 
> The old one says to trust email that comes from a specific IP-address.
> The new one says to trust it if it comes from a range of IP-addresses.
> 
> The SMTP-server operator has big volumes, and uses multiple addresses.
> 
> CHANGED AGAIN TO:
> v=spf1 +a +mx +include:spf.hostingplatform.net.au ~all
> 
> Both new entries *ought* to leave no clues for Rocketmail's Artificial
> Stupidity to trip over - although the first works only if ISP's
> wholesale provider stays within that range of IP-addresses.  Networked
> business topologies are *so* much more efficient, right??
> 
> _______________________
> 
> On 22/11/20 1:12 pm, Chris Maltby wrote:
>> I'm not sure that your xamax.com.au SPF details are good.
>>
>> xamax.com.au: "v=spf1 *ip4:103.27.32.5* +include:retailspf.smtp.com ?all"
>> retailspf.smtp.com: "v=spf1 ip4:192.40.160.0/19 ip4:74.91.80.0/20 ~all"
>>
>> but the sending address at syd.hostingplatform.net.au is 103.27.32.232.
>> You could try changing the ip4:103.27.32.5 to ip4:103.27.32.0/24.
>>
>> You might also want to set up a DMARC record so that you can receive
>> reports of messages that fail SPF/DKIM/ARC checks.
>>
>> Yahoo is one of the fussiest, but also seems to permit the most real spam...
>>
>> Chris
>>
>> On 21/11/2020 7:14 am, Roger Clarke wrote:
>>> If anyone can point me to relevant sources to help me understand and
>>> address the following problem, I'd be very appreciative!
> 
> _______________________
> 
> Roger Clarke                            mailto:Roger.Clarke at xamax.com.au
> T: +61 2 6288 6916   http://www.xamax.com.au  http://www.rogerclarke.com
> 
> Xamax Consultancy Pty Ltd      78 Sidaway St, Chapman ACT 2611 AUSTRALIA
> 
> Visiting Professor in the Faculty of Law            University of N.S.W.
> Visiting Professor in Computer Science    Australian National University
> _______________________________________________
> Link mailing list
> Link at mailman.anu.edu.au
> http://mailman.anu.edu.au/mailman/listinfo/link
> 

-- 
Kim Holburn
IT Network & Security Consultant
T: +61 2 61402408  M: +61 404072753
mailto:kim at holburn.net  aim://kimholburn
skype://kholburn - PGP Public Key on request