RE: More on Testing SRS

> From: Michael Weiner
> Sent: Sunday, June 13, 2004 10:16 AM
>
>
> Interesting i just got a bounce from the dk mailing list on sourceforge.
> net as in the following:
>
> The original message was received at Sun, 13 Jun 2004 11:16:23 -0400
> from dsl-eth0.userfriendly.net [68.22.33.182] (may be forged)

OK, this is your domain.  The PTR record for this IP is
adsl-68-22-33-182.dsl.bcvloh.ameritech.net, which probably explains the (may
be forged) warning.  The A record for that host name point to the same IP,
so it's could just be your HELO string.

>
>    ----- The following addresses had permanent fatal errors -----
> <[email protected]>
>     (reason: 550-Verification failed for
> <[email protected]>)

It looks like they are running a DomainKeys milter, but it is smart enough
to recognize an SRS-rewritten address.

>
>    ----- Transcript of session follows -----
> ... while talking to mail.sourceforge.net.:
> >>> DATA
> <<< 550-Verification failed for
> <[email protected]>
> <<< 550-Called:   68.22.33.177

Their milter did a sender callback (CBV) to your MX to validate the
SRS-signed MAIL FROM: address.  Nice anti-spoofing touch on their part.

> <<< 550-Sent:     RCPT TO:
> <[email protected]>
> <<< 550-Response: 550 5.1.1
> <[email protected]>... User
> unknown

Your MX responded negatively to the CBV.  It looks like the problem is at
your end.

> <<< 550 Sender verify failed
> 550 5.1.1 <[email protected]>... User
> unknown
> <<< 503 valid RCPT command must precede DATA

SourceForge did the right thing.  The sending system said the MAIL FROM:
address was no good, so SourceForge the mail.

>
> At least this confirms that my MTA is truly doing the envelope rewriting
> but IS this verification failing on MY end or as i take it, on SF's
> end???

Look like you need to configure your MX to respond to CBV's, and it must
have the capability of validating SRS-signed addresses.

--

Seth Goodman