Re: How do you handle SPF errors?
Alessandro Vesely <[email protected]>
| Newsgroups | gmane.mail.imap.courier.general |
|---|---|
| Message-ID | <[email protected]> |
On Fri 01/Dec/2023 01:40:49 +0100 Sam Varshavchik wrote: > Alessandro Vesely writes: >> I received a #@[] bounce for a non-existing [email protected]. I host >> cavaliere.it. The domain has spf-all. That Noreply asked for a positive >> DSN, which was sent and then bounced to me. The original message should have >> been blocked, but they managed to generate an error, and I accept "error" in >> BOFHSPFMAILFROM (and "all" in BOFHSPFFROM). >> >> I have the message header from the bounce. I only copy Received-SPF lines: >> >> Received-SPF: error (Address does not pass the Sender Policy Framework) >> [...] >> >> Any idea how they issued an error? >> >> Does people reject on error as well as on fail? > > Your SPF includes a lookup against list.dnswl.org > > If the lookup fails, looks like that'll be an ERROR. This is vulnerable to DNS > hiccups. I think it's a random DNS hiccup. Hm... named logs are not so explicit as one would like: north:log$ grep '148.19.188.64.list.dnswl.org' named-qu.log.0 30-Nov-2023 15:58:23.901 queries: info: client @0x7f281e72ff68 127.0.0.1#54827 (148.19.188.64.list.dnswl.org): view internal: query: 148.19.188.64.list.dnswl.org IN A + (127.0.0.1) 30-Nov-2023 15:58:28.909 queries: info: client @0x7f281e6add68 127.0.0.1#54827 (148.19.188.64.list.dnswl.org): view internal: query: 148.19.188.64.list.dnswl.org IN A + (127.0.0.1) 30-Nov-2023 15:58:30.357 queries: info: client @0x7f2817485f68 127.0.0.1#53802 (148.19.188.64.list.dnswl.org): view internal: query: 148.19.188.64.list.dnswl.org IN A + (127.0.0.1) 30-Nov-2023 15:58:31.621 queries: info: client @0x7f281f459f68 127.0.0.1#53122 (148.19.188.64.list.dnswl.org): view internal: query: 148.19.188.64.list.dnswl.org IN A + (127.0.0.1) north:log$ grep '148.19.188.64.list.dnswl.org' named.log.0 30-Nov-2023 15:58:35.689 lame-servers: info: success resolving '148.19.188.64.list.dnswl.org/A' after disabling qname minimization due to 'ncache nxdomain' The fourth query could have been made by spamassassin. I asked on bind users and they said the lame-servers line means "that the servers for the zone doesn’t fully implement the DNS protocol, but didn't say whether there was an error, nor whether it could've been orchestrated by the bad guy. It should return 4xx on DNS hiccups. That behavior shouldn't be difficult to code, but what bofh setting would make it? Best Ale -- _______________________________________________ courier-users mailing list [email protected] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users