<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Courier New";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>Sounds good. The thing about SPF is it validates where a message is *<b>from</b>*, not to. Basically, you tell it (in DNS) which servers are authorized to send mail as <a href="mailto:SOMEONE@cnm.edu">SOMEONE@cnm.edu</a>. It’s not so much a filter for inbound mail as it is a way for mail servers to determine whether mail actually came from your server or not. The effect of that however is that you can filter on mail coming in because you can verify the source. If it came from one the hosts you’ve authorized, it’s valid, at least as far as SPF is concerned. And if I receive a message that claims to be from you, I can also validate the source.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>Linux Journal had a couple of good articles on it about 6 or 7 years ago. You might hit their web site and see if they’re still available. They’re worth the read…<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;color:#1F497D'> ...Kevin<br>--<br>Kevin Miller<br>Network/email Administrator, CBJ MIS Dept.<br>155 South Seward Street<br>Juneau, Alaska 99801<br>Phone: (907) 586-0242, Fax: (907) 586-4500<br>Registered Linux User No: 307357</span><span style='color:#1F497D'> </span><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] <b>On Behalf Of </b>Robert Lopez<br><b>Sent:</b> Wednesday, March 20, 2013 2:22 PM<br><b>To:</b> MailScanner discussion<br><b>Subject:</b> Re: Watermarking and spoofed sender address<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><div><div><div><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>Kevin,<o:p></o:p></p></div><p class=MsoNormal>You have pointed to several things I need to look into. All our senders send and receive as <a href="mailto:someone@cnm.edu">someone@cnm.edu</a>. The email gateways forward all email to anyone who is a students on to gmail.<o:p></o:p></p></div><p class=MsoNormal>No there is no specific SPF milter on inbound server. Yes MailScanner is accepting mail from the outside for all users.<o:p></o:p></p></div><p class=MsoNormal>I will contact the SPF mailing list. Thanks.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>On Wed, Mar 20, 2013 at 12:48 PM, Kevin Miller <<a href="mailto:Kevin_Miller@ci.juneau.ak.us" target="_blank">Kevin_Miller@ci.juneau.ak.us</a>> wrote:<o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>It’s not clear to me how you’re sending/receiving mail. Do users send/receive as <a href="mailto:someone@gmail.com" target="_blank">someone@gmail.com</a> or <a href="mailto:someone@cnm.edu" target="_blank">someone@cnm.edu</a>?</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>Also, you have SPF set to softfail. That will flag a message as a fail, but doesn’t actually deny it. Are you running an SPF milter on your inbound server? I presume that you have a MailScanner host that is accepting mail from the outside for your users. </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>There’s an SPF mailing list, similar to this list. Probably best to jump onto it. There’s some sharp guys over there…</span><o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:10.0pt;color:#1F497D'> ...Kevin<br>--<br>Kevin Miller<br>Network/email Administrator, CBJ MIS Dept.<br>155 South Seward Street<br>Juneau, Alaska 99801<br>Phone: <a href="tel:%28907%29%20586-0242" target="_blank">(907) 586-0242</a>, Fax: <a href="tel:%28907%29%20586-4500" target="_blank">(907) 586-4500</a><br>Registered Linux User No: 307357</span><span style='color:#1F497D'> </span><o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a> [mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a>] <b>On Behalf Of </b>Robert Lopez<br><b>Sent:</b> Wednesday, March 20, 2013 9:28 AM<br><b>To:</b> MailScanner discussion<br><b>Subject:</b> Re: Watermarking and spoofed sender address</span><o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'>Kevin,<o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'>If we do use SPF could there be something in the way we use it that it does not help? We added it as part of our out soucing student email.<br><br>From <a href="http://www.kitterman.com/getspf2.py" target="_blank">http://www.kitterman.com/getspf2.py</a> as of Wed Mar 20 2013:<br>"<br>SPF record lookup and validation for: <a href="http://cnm.edu" target="_blank">cnm.edu</a><br>SPF records are primarily published in DNS as TXT records.<br><br>The TXT records found for your domain are:<br>v=spf1 include:_<a href="http://spf.google.com" target="_blank">spf.google.com</a> mx ~all<br><br>SPF records should also be published in DNS as type SPF records.<br><br>Type SPF records found for the domain are:<br>v=spf1 include:_<a href="http://spf.google.com" target="_blank">spf.google.com</a> mx ~all<br><br>Checking to see if there is a valid SPF record.<br><br>Results - Record may be valid, but ambiguous: v=spf1 records of both type TXT and SPF (type 99) present, but not identical<br><br>Found v=spf1 record for <a href="http://cnm.edu" target="_blank">cnm.edu</a>:<br>v=spf1 include:_<a href="http://spf.google.com" target="_blank">spf.google.com</a> mx ~all<br><br>evaluating...<br>SPF record passed validation test with pySPF (Python SPF library)!<br>"<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'> <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On Wed, Mar 20, 2013 at 10:20 AM, Kevin Miller <<a href="mailto:Kevin_Miller@ci.juneau.ak.us" target="_blank">Kevin_Miller@ci.juneau.ak.us</a>> wrote:<o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>For what you’re trying to do, SPF is a better option. </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:10.0pt;color:#1F497D'> ...Kevin<br>--<br>Kevin Miller<br>Network/email Administrator, CBJ MIS Dept.<br>155 South Seward Street<br>Juneau, Alaska 99801<br>Phone: <a href="tel:%28907%29%20586-0242" target="_blank">(907) 586-0242</a>, Fax: <a href="tel:%28907%29%20586-4500" target="_blank">(907) 586-4500</a><br>Registered Linux User No: 307357</span><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a> [mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a>] <b>On Behalf Of </b>Robert Lopez<br><b>Sent:</b> Tuesday, March 19, 2013 3:58 PM<br><b>To:</b> MailScanner discussion<br><b>Subject:</b> Watermarking and spoofed sender address</span><o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'>I understand watermarking is to defend against "joe job blowback". I think I understand that blowback problem is when email is sent, using for example my address, to many other domains and all the flack (blow back) comes back to me.<o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I am wondering if this watermarking is of any use in a type of SPAM we now frequently see. It is where email is sent to a list of addresses, all at our domain, and the from address is also the first address in the address list. Everyone else thinks the first person sent it. Our gateways send such email to Exchange and any communication back to the sender is entirely within Exchange and never comes back through the gateways again. <br><br>In this kind of SPAM I have always considered it of no use. Am I wrong in my thinking?<br clear=all><o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><br>-- <br>Robert Lopez<br>Unix Systems Administrator<br>Central New Mexico Community College (CNM)<br>525 Buena Vista SE<br>Albuquerque, New Mexico 87106 <o:p></o:p></p></div></div></div></div></div></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'><br>--<br>MailScanner mailing list<br><a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br><br>Support MailScanner development - buy the book off the website!<o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><br><br clear=all><br>-- <br>Robert Lopez<br>Unix Systems Administrator<br>Central New Mexico Community College (CNM)<br>525 Buena Vista SE<br>Albuquerque, New Mexico 87106 <o:p></o:p></p></div></div></div></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>--<br>MailScanner mailing list<br><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br><br>Support MailScanner development - buy the book off the website!<o:p></o:p></p></div><p class=MsoNormal><br><br clear=all><br>-- <br>Robert Lopez<br>Unix Systems Administrator<br>Central New Mexico Community College (CNM)<br>525 Buena Vista SE<br>Albuquerque, New Mexico 87106 <o:p></o:p></p></div></div></body></html>