Re: spf record checker

To beat this thing dead, it's also possible to spoof the IPs that show up i=
n headers.   Checking those would be problematic.

The actual IP of the incoming connection is checked as it is a lot more dif=
ficult to fake it.

=3D- Tim


> On Sep 25, 2013, at 1:58 PM, alan <[email protected]> wrote:
>=20
> At 17:07 25/09/2013  Wednesday, Tim Draegen wrote:
>> Hi Roman,
>>=20
>> Only the last hop's IP address is checked.
>=20
> what he said ;)
> any all internal-to-sender hops are irrelevant and usually RFC1918 addres=
ses anyway
>=20
> only the ip(s) that connect to receivers edge servers are checked (during=
 the connection to the edge servers usually)
> and the checks are done before the email is even sent/received so none of=
 the other hops can possibly be known about (as their are no headers yet se=
nt to read)
>=20
> and equally the receivers internal hops equally are ignored
>=20
> mail conversation (yes there is more to it than this in some cases startl=
s for example but in general this is all there is to it from an spf standpo=
int)
>=20
> connection received from ww.xx.yy.zz
> (at this point ip based blacklists can be checked **)
> helo recieving.server.name    [sent]
> helo/ehlo sending.server.name  [recieved]
> 2xx OK                             [Sent]
> (at this point the receiving server can/should spf check postmaster@sendi=
ng.server.name **)
> mail from: <[email protected]> [recieved]
> 2xx OK                               [sent]
> (at this point the receiving server can/should spf check [email protected]=
ain **)
> rcpt to: <[email protected]> [recieved]
> response is either
> 5xx  (the reason why you do not want the email due to blacklisting/either=
 spf failure/any other local policy issue)
> 4xx  (come back later due to greylisting mailbox full whatever)
> 2xx OK (if all checks non-fatal failure)
>=20
> **it must cache the result as no reject for any reason will be understood=
 till after RCPT
>=20
> so as you can see at the point the spf test is done only the senders ip a=
nd the domain being checked are known to the server
>=20
>=20
>=20
>> Hth,
>>=20
>>=20
>> =3D- Tim
>>=20
>>=20
>>> On Sep 25, 2013, at 11:48 AM, Roman Gelfand <[email protected]> wrote:
>>>=20
>>> I am including ipv4 subnet entries in my spf record.  if email makes
>>> serveral server hops before it's final destination, is it a correct
>>> behavior of spf checker to check each hop's ip address or spf checker
>>> should be only checking final from hop?
>>>=20
>>> Thanks in advance
>>>=20
>>>=20
>>> -------------------------------------------
>>> Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>>> Modify Your Subscription: http://www.listbox.com/member/ [http://www.li=
stbox.com/member/]
>>>=20
>>> Archives: https://www.listbox.com/member/archive/735/=3Dnow
>>> RSS Feed: https://www.listbox.com/member/archive/rss/735/20433905-a505b=
78c
>>> Modify Your Subscription: https://www.listbox.com/member/?&
>>> Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=3D20130=
925114848:F3A5379E-25F9-11E3-9F78-9D785B1D7A34
>>> Powered by Listbox: http://www.listbox.com
>>=20
>>=20
>> -------------------------------------------
>> Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>> Modify Your Subscription: http://www.listbox.com/member/ [http://www.lis=
tbox.com/member/]
>>=20
>> Archives: https://www.listbox.com/member/archive/735/=3Dnow
>> RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-ec5a05=
68
>> Modify Your Subscription: https://www.listbox.com/member/?&
>> Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=3D201309=
25120744:9A71E12E-25FC-11E3-8F23-D7419C1E9369
>> Powered by Listbox: http://www.listbox.com
>=20
>=20
>=20
> -------------------------------------------
> Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
> Modify Your Subscription: http://www.listbox.com/member/ [http://www.list=
box.com/member/]
>=20
> Archives: https://www.listbox.com/member/archive/735/=3Dnow
> RSS Feed: https://www.listbox.com/member/archive/rss/735/20433905-a505b78c
> Modify Your Subscription: https://www.listbox.com/member/?&
> Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=3D2013092=
5135830:1284BA88-260C-11E3-B31F-F40B53C51272
> Powered by Listbox: http://www.listbox.com