Recommended Posts

I've recently been getting a perculiar kind of spam, I'm having a little trouble figuring out why it's avoiding the spam filter.

My email setup: I'm using google apps. I have records for SPF (the generic google one), DKIM (unique), and DMARC. My DMARC policy is using default values (but p=quarantine), which uses relaxed alignment mode for both SPF and DKIM as well as letting mail through if either passes (to avoid f/p of forwarding servers).

Basically, this new spam claims to come from my own domain, which it obviously isn't. Now usually this wouldn't be a problem since it should fail both SPF and DKIM. But it looks like this breed is passing (or at least not failing) SPF for some reason. I'm referring specifically to "Received-SPF" and "Authentication-Results", which makes it look like they're using a Gmail account to originate the spam, but the Gmail account itself obviously can't spoof email addresses on my domain. Later down it appears that they are, in fact, using a third party sender, but how does it pass SPF?

I'm quite confused about this header, could anyone with more experience in this area shed some light as to what's actually happening? Is there any change I can make to the DMARC policy to filter this out?

Thanks!


Delivered-To: [email protected]
Received: by 10.223.161.66 with SMTP id q2csp29576fax;
Sat, 16 Feb 2013 13:11:56 -0800 (PST)
X-Received: by 10.220.116.5 with SMTP id k5mr9087041vcq.55.1361049116195;
Sat, 16 Feb 2013 13:11:56 -0800 (PST)
Return-Path: <[email protected]>
Received: from 201-212-133-238.cab.prima.net.ar (201-212-133-238.cab.prima.net.ar. [201.212.133.238])
by mx.google.com with ESMTP id a1si13647855vdk.21.2013.02.16.13.11.54;
Sat, 16 Feb 2013 13:11:56 -0800 (PST)
Received-SPF: neutral (google.com: 201.212.133.238 is neither permitted nor denied by domain of [email protected]) client-ip=201.212.133.238;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 201.212.133.238 is neither permitted nor denied by domain of [email protected]) [email protected]
Message-ID: <[email protected]>
Date: Sat, 16 Feb 2013 18:25:48 -0300
From: <[email protected]>,
<[email protected]>,
<[email protected]>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6
MIME-Version: 1.0
To: <[email protected]>,
<[email protected]>,
<[email protected]>
Subject: Take a spare three-hour work week in our clinic and get 580 dollars.
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
[/CODE]

Link to comment
https://www.neowin.net/forum/topic/1136888-help-analyzing-email-header/
Share on other sites

It might be this address:


[email protected] and/or
[email protected]
[/CODE]

Which you got this today or yesterday... then next email you will get same address with random numbers such as 145, 160, 134... which is why you still get spam in your inbox. If you want to block them... block them with any words you might find in the body or subject line... such as viagra, so you can add them to your blacklist.

gmail spf is not very locked down, if you check that IP against it - if you check any IP against it comes up as neutral

201.212.133.238 may send in the name of the domain.

  • SPF check start.
    • Domain: gmail.com

    [*]Getting SPF (TXT) record.

    [*]Found SPF record.

    [*]SPF policy record data:

    • v=spf1 redirect=_spf.google.com

    [*]Evaluating SPF policy:

    • v=spf1 redirect=_spf.google.com

    [*]Policy parsed OK, no warnings.

    [*]Evaluating SPF policy string.

    • Following the "redirect" modifier.
      • Argument domain-spec: _spf.google.com

      • Domain argument after macro expansion:
        • _spf.google.com

      • SPF check start.
        • Domain: _spf.google.com

      • Getting SPF (TXT) record.

      • Found SPF record.

      • SPF policy record data:
        • v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ?all

      • Evaluating SPF policy:
        • v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ?all

      • Policy parsed OK, no warnings.

      • Evaluating SPF policy string.
        • Evaluating SPF mechanism "include".
          • Prefix: Pass.

          • Argument domain-spec: _netblocks.google.com

          • Domain argument after macro expansion:
            • _netblocks.google.com

          • SPF check start.
            • Domain: _netblocks.google.com

          • Getting SPF (TXT) record.

          • Found SPF record.

          • SPF policy record data:
            • v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all

          • Evaluating SPF policy:
            • v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all

          • Policy parsed OK, no warnings.

          • Evaluating SPF policy string.
            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 216.239.32.0

              • Argument ip4-cidr-length: 19

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 64.233.160.0

              • Argument ip4-cidr-length: 19

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 66.249.80.0

              • Argument ip4-cidr-length: 20

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 72.14.192.0

              • Argument ip4-cidr-length: 18

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 209.85.128.0

              • Argument ip4-cidr-length: 17

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 66.102.0.0

              • Argument ip4-cidr-length: 20

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 74.125.0.0

              • Argument ip4-cidr-length: 16

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 64.18.0.0

              • Argument ip4-cidr-length: 20

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 207.126.144.0

              • Argument ip4-cidr-length: 20

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 173.194.0.0

              • Argument ip4-cidr-length: 16

            • Evaluating SPF mechanism "all".
              • Prefix: Neutral.

            • SPF mechanism "all" matched with prefix Neutral.

          • Finished evaluating SPF policy.

          • SPF policy evaluation finished with SPF Neutral.

        • Evaluating SPF mechanism "include".
          • Prefix: Pass.

          • Argument domain-spec: _netblocks2.google.com

          • Domain argument after macro expansion:
            • _netblocks2.google.com

          • SPF check start.
            • Domain: _netblocks2.google.com

          • Getting SPF (TXT) record.

          • Found SPF record.

          • SPF policy record data:
            • v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ?all

          • Evaluating SPF policy:
            • v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ?all

          • Policy parsed OK, no warnings.

          • Evaluating SPF policy string.
            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • Evaluating SPF mechanism "all".
              • Prefix: Neutral.

            • SPF mechanism "all" matched with prefix Neutral.

          • Finished evaluating SPF policy.

          • SPF policy evaluation finished with SPF Neutral.

        • Evaluating SPF mechanism "include".
          • Prefix: Pass.

          • Argument domain-spec: _netblocks3.google.com

          • Domain argument after macro expansion:
            • _netblocks3.google.com

          • SPF check start.
            • Domain: _netblocks3.google.com

          • Getting SPF (TXT) record.

          • Found SPF record.

          • SPF policy record data:
            • v=spf1 ?all

          • Evaluating SPF policy:
            • v=spf1 ?all

          • Policy parsed OK, no warnings.

          • Evaluating SPF policy string.
            • Evaluating SPF mechanism "all".
              • Prefix: Neutral.

            • SPF mechanism "all" matched with prefix Neutral.

          • Finished evaluating SPF policy.

          • SPF policy evaluation finished with SPF Neutral.

        • Evaluating SPF mechanism "all".
          • Prefix: Neutral.

        • SPF mechanism "all" matched with prefix Neutral.

      • Finished evaluating SPF policy.

      • SPF policy evaluation finished with SPF Neutral.

    • Returned from redirection.

    [*]Finished evaluating SPF policy.

    [*]SPF policy evaluation finished with SPF Neutral.

So did a test with just random ****.. 1.2.3.4 may send in the name of the domain.

http://vamsoft.com/s...f-policy-tester

You can use this is well http://www.kitterman...f/validate.html, you can pretty much test anything with a gmail.com domain and you get neutral..

if you notice their record

v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ?all

So since using ?, they never fail anything - so what is the point of the policy?? ;) They really should have a - for their policy.

Each mechanism can be combined with one of four qualifiers:

  • + for a PASS result. This can be omitted; e.g., +mx is the same as mx.
  • ? for a NEUTRAL result interpreted like NONE (no policy).
  • ~ (tilde) for SOFTFAIL, a debugging aid between NEUTRAL and FAIL. Typically, messages that return a SOFTFAIL are accepted but tagged.
  • - (minus) for FAIL, the mail should be rejected (see below).

your hopeless using spf to filter on - its going to be neutral.. But sure there is something else you could filter on.. is the spam all coming from that IP? Got to be some key words to block.. Can you just report as spam, normally gmail updates their filtering.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Oddly, there was a time that UFC games were culturally relevant, largely because of the graphics and gameplay that was different than the norm. But it seems like as the sport grew in popularity, gaming outlets stopped talking about the games.
    • Microsoft Edge 149.0.4022.69 by Razvan Serea Microsoft Edge is a super fast and secure web browser from Microsoft. It works on almost any device, including PCs, iPhones and Androids. It keeps you safe online, protects your privacy, and lets you browse the web quickly. You can even use it on all your devices and keep your browsing history and favorites synced up. Built on the same technology as Chrome, Microsoft Edge has additional built-in features like Startup boost and Sleeping tabs, which boost your browsing experience with world class performance and speed that are optimized to work best with Windows. Microsoft Edge security and privacy features such as Microsoft Defender SmartScreen, Password Monitor, InPrivate search, and Kids Mode help keep you and your loved ones protected and secure online. Microsoft Edge has features to keep both you and your family protected. Enable content filters and access activity reports with your Microsoft Family Safety account and experience a kid-friendly web with Kids Mode. The new Microsoft Edge is now compatible with your favorite extensions, so it’s easy to personalize your browsing experience. Microsoft Edge 149.0.4022.69 changelog: Fixed an issue that caused the Downloads dialog to continue displaying the "Keep/Delete" prompt for .rdp files after the download completed. Stable channel security updates are listed here. Download: Microsoft Edge (64-bit) | 193.0 MB (Freeware) Download: Microsoft Edge (32-bit) | 170.0 MB Download: Microsoft Edge (ARM64) | 188.0 MB View: Microsoft Edge Website | Release History Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Save 44% on Intuit QuickBooks Desktop Pro Plus 2024 (1 User for 1-Year) by Steven Parker Today's highlighted deal comes via our Apps + Software section of the Neowin Deals store, where for only a limited time, you can save 44% on Intuit QuickBooks Desktop Pro Plus 2024 (1 User + 1 Year) for Windows. Take control of your business finances with Intuit® QuickBooks® Desktop Pro Plus 2024 Lifetime Activation for Windows. This powerful accounting software simplifies bookkeeping, expense tracking, invoicing, and financial management—all in one intuitive platform. Designed for small business owners, freelancers, and accountants, QuickBooks® Desktop Pro Plus 2024 ensures accuracy, efficiency, and seamless transaction tracking. Stay organized, save time, and manage your finances with confidence—no subscriptions, just lifetime access! Financial and business management Comprehensive Financial Management: Gain access to a full suite of features designed to handle everything from creating invoices & managing expenses to generating reports and tracking sales. Enhanced Reporting Tools: Generate professional reports & insights to make informed financial decisions and help you stay ahead of your business goals. Job Costing: Track the profitability of specific jobs or projects. Fixed Asset Management: Track the depreciation & value of fixed assets. Customer & Vendor Management: Organize information, streamline communication & enhance customer relations. Sales Order Processing: Create & manage sales orders from start to finish. Purchase Order Processing: Create & manage purchase orders to streamline vendor payments. Improved Inventory Management: Enhanced features for tracking inventory levels & costs. Automation, integration, and support Enhanced Bank Feeds: Web Connect (manual QBO imports), works on all licenses for easier bank reconciliation Time Tracking: Track employee time to accurately calculate payroll and project costs Easy Data Import: Quickly transfer financial data from Excel or older QuickBooks® versions Why choose Intuit® QuickBooks® Desktop Pro Plus 2024? Effortless Installation: Quick and easy setup with step-by-step guidance. No Hidden Costs: One-time payment—no subscriptions or recurring fees. Direct Official Download: Access the software securely from the official QuickBooks® website. Stay Up to Date: Get the latest updates and features for optimal performance. Multilingual Support: Available in multiple languages to suit your needs. Lifetime Access: A one-time purchase means no ongoing costs. IMPORTANT: Cloud integrations (QuickBooks Payments, TurboTax, and Online logins) are NOT included. Good to know: Length of access: lifetime Redemption deadline: redeem your code within 30 days of purchase Access options: Windows Max number of device(s): 2 (for 1 user only and can't be used simultaneously) Version: 2024 (United States) 64-bit Available to both NEW and EXISTING users For US customers only Updates included An Intuit QuickBooks Desktop Pro Plus 2024 (1 User + 1-Year) for Windows: Lifetime License normally costs $536, but it can be yours for just $299.99 for a limited time, a saving of $236. There are also other plans available. For specifications, and license info please click the link below. Get Intuit QuickBooks Desktop Pro Plus 2024 for just $299.99 This is a time limited deal For US customers only. Support queries If you have queries or need support for any of the Neowin Deals, please use the contact form here. Neowin Deals are managed and sold by StackCommerce who represent Neowin on an affiliate basis. Why we post these deals We post these because we earn commission on each sale so as not to rely solely on advertising, which many of our readers block. It all helps toward paying staff reporters, servers and hosting costs. So for those that keep moaning and complaining, be thankful we're still online for you to even do that. Other ways to support Neowin Whitelist Neowin by not blocking our ads Create a free member account to see fewer ads Make a donation to support our day to day running costs Subscribe to Neowin - for $14 a year, or $28 a year for an ad-free experience Disclosure: Neowin benefits from revenue of each sale made through our branded deals site powered by StackCommerce.
    • AFAIK you shouldn't be getting a consent popup at all from Canada, so I think it is to do with a VPN or private/secure DNS.
    • From what I see it's only for Insider - preview builds. Not for everybody. So...
  • Recent Achievements

    • Week One Done
      agatameier earned a badge
      Week One Done
    • One Month Later
      agatameier earned a badge
      One Month Later
    • Week One Done
      ssd21345 earned a badge
      Week One Done
    • Contributor
      MarkHughes4096 went up a rank
      Contributor
    • Dedicated
      jordanspringer earned a badge
      Dedicated
  • Popular Contributors

    1. 1
      +primortal
      507
    2. 2
      +Edouard
      175
    3. 3
      PsYcHoKiLLa
      139
    4. 4
      ATLien_0
      90
    5. 5
      Steven P.
      76
  • Tell a friend

    Love Neowin? Tell a friend!