<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<STYLE type=text/css>DIV {
MARGIN: 0px
}
P {
MARGIN: 0px
}
</STYLE>
<META content="MSHTML 6.00.2900.2802" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=248465420-04042006><FONT
face="Comic Sans MS" color=#000080 size=2>There's two aspects of
SPF. The first is your SPF records which are in your DNS. The
specify which domains are permitted to send mail claiming to be from your
domain. Essentially it's a list of computers authorized to send on your
behalf.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=248465420-04042006><FONT
face="Comic Sans MS" color=#000080 size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=248465420-04042006><FONT
face="Comic Sans MS" color=#000080 size=2>The other aspect is SPF records in
other folks domains. For instance, I have specific servers listed in my
dns with SPF records. If someone out in spam-land tries to send a message
from bogus-server.ci.juneau.ak.us, your server will look at the
address, do a lookup on my dns servers for the corresponding SPF record, note
that the sending server isn't one of the authorized servers and it will
fail. In my case it's a hard fail but many people set it to soft fail
initially.</FONT></SPAN></DIV>
<DIV><FONT face="Comic Sans MS" color=#000080 size=2></FONT> </DIV>
<DIV><SPAN class=248465420-04042006><FONT face="Comic Sans MS" color=#000080
size=2>What you're seeing is spammers pretending to send from a domain that
isn't theirs. It appears to be working as advertised.</FONT></SPAN></DIV>
<DIV><SPAN class=248465420-04042006><FONT face="Comic Sans MS" color=#000080
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=248465420-04042006><FONT face="Comic Sans MS" color=#000080
size=2>Not sure about the spam count question...</FONT></SPAN></DIV>
<DIV><SPAN class=248465420-04042006></SPAN> </DIV><!-- Converted from text/plain format -->
<P><FONT size=2>...Kevin<BR>--<BR>Kevin
Miller
Registered Linux User No: 307357<BR>CBJ MIS
Dept.
Network Systems Admin., Mail Admin.<BR>155 South Seward
Street ph: (907) 586-0242<BR>Juneau, Alaska
99801 fax: (907
586-4500<BR> </FONT> </P>
<DIV> </DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <B>On Behalf Of </B>Johnny
Stork<BR><B>Sent:</B> Tuesday, April 04, 2006 12:35 PM<BR><B>To:</B>
mailscanner@lists.mailscanner.info<BR><B>Subject:</B> SPF
Rules?<BR></FONT><BR></DIV>
<DIV></DIV><FONT face="arial, helvetica, sans-serif" size=3>I finally got around
to upgrading our MailScanner setup running on RHES4, I first used the tarball
for the clam/SA packages and then the MailScanner rpm upgrade tarball. All seems
fine and I am now trying to go through and address various issues that I have
not fully configured yet. For now I am trying to understand how the SPF rules
work. I know very little about SPF or how it is implemented in mailscanner, but
it seems that almost all messages trigger this rule below? Is this
normal<BR><BR>Score Rule
Description<BR>
<TABLE class=sa_rules_report cellSpacing=2 cellPadding=1 width="100%"
border=0><TBODY>
<TR>
<TD align=left>2.08</TD>
<TD width=200>SPF_HELO_SOFTFAIL</TD>
<TD>SPF: HELO does not match SPF record
(softfail)</TD></TR></TBODY></TABLE><BR>Also, when I go to the Bayes Database
Info section on MailWatch, I see that the count for SPAM has been at 198 and
even if I go to "Message Operations" locate a definite SPAM message, click the
SPAM box and the "Learn" the SPAM count does not increase? But this is probably
a question for the MailWatch list<BR><BR><BR><FONT size=+0><FONT size=+0><FONT
size=+0>_______________________________</FONT><BR><FONT size=+0><SPAN
style="FONT-WEIGHT: bold; COLOR: rgb(0,0,255)">Johnny
Stork</SPAN></FONT><BR><FONT size=+0><SPAN
style="COLOR: rgb(255,0,0)">Information & Technology Manager</SPAN><BR
style="COLOR: rgb(0,128,128)"><SPAN style="COLOR: rgb(0,128,128)">Provincial
Blood Coordinating Office</SPAN><BR style="COLOR: rgb(0,128,128)"><SPAN
style="COLOR: rgb(0,128,128)">604-806-8840</SPAN></FONT><BR></FONT><BR></FONT>l<BR></FONT></BODY></HTML>