9 messages in net.sourceforge.lists.courier-usersRe: [courier-users] SPF
FromSent OnAttachments
Mark ConstableJan 24, 2008 7:48 pm 
Alessandro VeselyJan 24, 2008 10:28 pm 
Alessandro VeselyJan 24, 2008 10:46 pm 
Mark ConstableJan 24, 2008 11:17 pm 
Alessandro VeselyJan 25, 2008 2:17 am 
Mark ConstableJan 25, 2008 2:56 am 
Alessandro VeselyJan 26, 2008 7:28 am 
Mark ConstableJan 28, 2008 6:35 pm 
Sam VarshavchikJan 28, 2008 7:54 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: [courier-users] SPFActions...
From:Alessandro Vesely (ves@tana.it)
Date:Jan 25, 2008 2:17:39 am
List:net.sourceforge.lists.courier-users

Mark Constable wrote:

On 25 Jan 2008 16:29, Alessandro Vesely wrote:

What was the HELO name they used? Perhaps you can retrieve the "newmsg" log entry for that message.

I couldn't find a related message to this particular SPF fail log entry but, separate issue, wouldn't the message be rejected before courierd got a hold of it?

Well, the message is rejected after the MAIL FROM command even if it was the helo name that failed, but the 517 response line quotes the address that failed. In your case it was the domain "bankwest.com.au".

Is it possible that the DNS changed after Jan 25 10:33:19 and before we manually checked it?

Now here is one that came in from the same IP, with a From: address from another domain that does not have a SPF record at all, and it was successfully delivered...

Jan 25 07:27:06 mail courierd: newmsg, id=00093385.479902A5.000001B2: dns; mail191.messagelabs.com (mail191.messagelabs.com [::ffff:216.82.241.83])

The SPF=HELO check should have passed with "none", since mail191.messagelabs.com has no TXT record. Did that message use "bankwest.com.au" in the MAILFROM?

BOFHSPFFROM defaults to "off", according to the docs, thus no Received-SPF for SPF=FROM should be present.