[milters] Archive

Lists Index Date Thread Search

Article: 1774
From: Jim Hermann - UUN Hostmaster
Date: 2007-10-07 23:32:29 -0400
Subject: Multiple IP Addresses in the SPF a: record

Removal...........: milters-request@milter.info?subject=remove
More information..: http://www.milter.info/#Support
--------------------------------------------------------

Can milter-spiff recognize when a SPF record has multiple IP Addresses in
the a: record?

Milter-spiff reported SPF SOFTFAIL while milter-greylist and Spamassassin
reported SPF_PASS.

The Mail::SpamAssassin::Plugin::SPF uses Mail::SPF v2.005  
The milter-greylist uses libspf2-1.2.5

Oct  7 09:34:46 host sm-acceptingconnections[11956]: l97EYklZ011956: Milter
add: header: X-Greylist: SPF_OK From alerts@citibank.com at IP
199.67.179.101 - Delayed for 00:35:50 by milter-greylist-4.0b2
(host.uuserver.net [69.94.104.180]); Sun, 07 Oct 2007 09:34:46 -0500 (CDT)
Oct  7 09:34:47 host sm-acceptingconnections[11956]: l97EYklZ011956: Milter
add: header: Received-SPF: SoftFail; receiver=; client-ip=199.67.179.101;
helo=mail.citigroup.com
Oct  7 09:34:47 host sm-acceptingconnections[11956]: l97EYklZ011956: Milter
add: header: Received-SPF: SoftFail; receiver=; client-ip=199.67.179.101;
envelope-from=<alerts@citibank.com>
Oct  7 09:34:47 host sm-acceptingconnections[11956]: l97EYklZ011956: Milter
change: header Subject: from Banking Alert to {SPF Failure}  Banking Alert
Oct  7 09:34:59 host MailScanner[9010]: Message l97EYklZ011956 from
199.67.179.101 (alerts@citibank.com) to uuism.net is not spam, SpamAssassin
(not cached, score=-7.401, required 5, autolearn=not spam, BAYES_00 -3.40,
HTML_MESSAGE 0.00, RCVD_IN_DNSWL_MED -4.00, SPF_HELO_PASS -0.00, SPF_PASS
-0.00)

The problem may be due to the SPF record for citibank.com: v=spf1
a:mail.citigroup.com ~all

Dig mail.citibank.com reports multiple 35 A records:

mail.citigroup.com.     3600    IN      A       199.67.204.181
[snip]
mail.citigroup.com.     3600    IN      A       199.67.179.101
[snip]
mail.citigroup.com.     3600    IN      A       199.67.204.180

Jim
-----
Jim Hermann <hostmaster@UUism.net>
UUism Networks <http://www.UUism.net>
Ministering to the Needs of Online UUs
Web Hosting, Email Services, Mailing Lists
-----


Lists Index Date Thread Search