Recommended Posts

I've recently been getting a perculiar kind of spam, I'm having a little trouble figuring out why it's avoiding the spam filter.

My email setup: I'm using google apps. I have records for SPF (the generic google one), DKIM (unique), and DMARC. My DMARC policy is using default values (but p=quarantine), which uses relaxed alignment mode for both SPF and DKIM as well as letting mail through if either passes (to avoid f/p of forwarding servers).

Basically, this new spam claims to come from my own domain, which it obviously isn't. Now usually this wouldn't be a problem since it should fail both SPF and DKIM. But it looks like this breed is passing (or at least not failing) SPF for some reason. I'm referring specifically to "Received-SPF" and "Authentication-Results", which makes it look like they're using a Gmail account to originate the spam, but the Gmail account itself obviously can't spoof email addresses on my domain. Later down it appears that they are, in fact, using a third party sender, but how does it pass SPF?

I'm quite confused about this header, could anyone with more experience in this area shed some light as to what's actually happening? Is there any change I can make to the DMARC policy to filter this out?

Thanks!


Delivered-To: [email protected]
Received: by 10.223.161.66 with SMTP id q2csp29576fax;
Sat, 16 Feb 2013 13:11:56 -0800 (PST)
X-Received: by 10.220.116.5 with SMTP id k5mr9087041vcq.55.1361049116195;
Sat, 16 Feb 2013 13:11:56 -0800 (PST)
Return-Path: <[email protected]>
Received: from 201-212-133-238.cab.prima.net.ar (201-212-133-238.cab.prima.net.ar. [201.212.133.238])
by mx.google.com with ESMTP id a1si13647855vdk.21.2013.02.16.13.11.54;
Sat, 16 Feb 2013 13:11:56 -0800 (PST)
Received-SPF: neutral (google.com: 201.212.133.238 is neither permitted nor denied by domain of [email protected]) client-ip=201.212.133.238;
Authentication-Results: mx.google.com;
spf=neutral (google.com: 201.212.133.238 is neither permitted nor denied by domain of [email protected]) [email protected]
Message-ID: <[email protected]>
Date: Sat, 16 Feb 2013 18:25:48 -0300
From: <[email protected]>,
<[email protected]>,
<[email protected]>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6
MIME-Version: 1.0
To: <[email protected]>,
<[email protected]>,
<[email protected]>
Subject: Take a spare three-hour work week in our clinic and get 580 dollars.
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
[/CODE]

Link to comment
https://www.neowin.net/forum/topic/1136888-help-analyzing-email-header/
Share on other sites

It might be this address:


[email protected] and/or
[email protected]
[/CODE]

Which you got this today or yesterday... then next email you will get same address with random numbers such as 145, 160, 134... which is why you still get spam in your inbox. If you want to block them... block them with any words you might find in the body or subject line... such as viagra, so you can add them to your blacklist.

gmail spf is not very locked down, if you check that IP against it - if you check any IP against it comes up as neutral

201.212.133.238 may send in the name of the domain.

  • SPF check start.
    • Domain: gmail.com

    [*]Getting SPF (TXT) record.

    [*]Found SPF record.

    [*]SPF policy record data:

    • v=spf1 redirect=_spf.google.com

    [*]Evaluating SPF policy:

    • v=spf1 redirect=_spf.google.com

    [*]Policy parsed OK, no warnings.

    [*]Evaluating SPF policy string.

    • Following the "redirect" modifier.
      • Argument domain-spec: _spf.google.com

      • Domain argument after macro expansion:
        • _spf.google.com

      • SPF check start.
        • Domain: _spf.google.com

      • Getting SPF (TXT) record.

      • Found SPF record.

      • SPF policy record data:
        • v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ?all

      • Evaluating SPF policy:
        • v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ?all

      • Policy parsed OK, no warnings.

      • Evaluating SPF policy string.
        • Evaluating SPF mechanism "include".
          • Prefix: Pass.

          • Argument domain-spec: _netblocks.google.com

          • Domain argument after macro expansion:
            • _netblocks.google.com

          • SPF check start.
            • Domain: _netblocks.google.com

          • Getting SPF (TXT) record.

          • Found SPF record.

          • SPF policy record data:
            • v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all

          • Evaluating SPF policy:
            • v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:209.85.128.0/17 ip4:66.102.0.0/20 ip4:74.125.0.0/16 ip4:64.18.0.0/20 ip4:207.126.144.0/20 ip4:173.194.0.0/16 ?all

          • Policy parsed OK, no warnings.

          • Evaluating SPF policy string.
            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 216.239.32.0

              • Argument ip4-cidr-length: 19

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 64.233.160.0

              • Argument ip4-cidr-length: 19

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 66.249.80.0

              • Argument ip4-cidr-length: 20

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 72.14.192.0

              • Argument ip4-cidr-length: 18

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 209.85.128.0

              • Argument ip4-cidr-length: 17

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 66.102.0.0

              • Argument ip4-cidr-length: 20

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 74.125.0.0

              • Argument ip4-cidr-length: 16

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 64.18.0.0

              • Argument ip4-cidr-length: 20

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 207.126.144.0

              • Argument ip4-cidr-length: 20

            • Evaluating SPF mechanism "ip4".
              • Prefix: Pass.

              • Argument network-spec: 173.194.0.0

              • Argument ip4-cidr-length: 16

            • Evaluating SPF mechanism "all".
              • Prefix: Neutral.

            • SPF mechanism "all" matched with prefix Neutral.

          • Finished evaluating SPF policy.

          • SPF policy evaluation finished with SPF Neutral.

        • Evaluating SPF mechanism "include".
          • Prefix: Pass.

          • Argument domain-spec: _netblocks2.google.com

          • Domain argument after macro expansion:
            • _netblocks2.google.com

          • SPF check start.
            • Domain: _netblocks2.google.com

          • Getting SPF (TXT) record.

          • Found SPF record.

          • SPF policy record data:
            • v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ?all

          • Evaluating SPF policy:
            • v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ?all

          • Policy parsed OK, no warnings.

          • Evaluating SPF policy string.
            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • IP6 mechanism evaluation is not implemented.

            • Evaluating SPF mechanism "all".
              • Prefix: Neutral.

            • SPF mechanism "all" matched with prefix Neutral.

          • Finished evaluating SPF policy.

          • SPF policy evaluation finished with SPF Neutral.

        • Evaluating SPF mechanism "include".
          • Prefix: Pass.

          • Argument domain-spec: _netblocks3.google.com

          • Domain argument after macro expansion:
            • _netblocks3.google.com

          • SPF check start.
            • Domain: _netblocks3.google.com

          • Getting SPF (TXT) record.

          • Found SPF record.

          • SPF policy record data:
            • v=spf1 ?all

          • Evaluating SPF policy:
            • v=spf1 ?all

          • Policy parsed OK, no warnings.

          • Evaluating SPF policy string.
            • Evaluating SPF mechanism "all".
              • Prefix: Neutral.

            • SPF mechanism "all" matched with prefix Neutral.

          • Finished evaluating SPF policy.

          • SPF policy evaluation finished with SPF Neutral.

        • Evaluating SPF mechanism "all".
          • Prefix: Neutral.

        • SPF mechanism "all" matched with prefix Neutral.

      • Finished evaluating SPF policy.

      • SPF policy evaluation finished with SPF Neutral.

    • Returned from redirection.

    [*]Finished evaluating SPF policy.

    [*]SPF policy evaluation finished with SPF Neutral.

So did a test with just random ****.. 1.2.3.4 may send in the name of the domain.

http://vamsoft.com/s...f-policy-tester

You can use this is well http://www.kitterman...f/validate.html, you can pretty much test anything with a gmail.com domain and you get neutral..

if you notice their record

v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ?all

So since using ?, they never fail anything - so what is the point of the policy?? ;) They really should have a - for their policy.

Each mechanism can be combined with one of four qualifiers:

  • + for a PASS result. This can be omitted; e.g., +mx is the same as mx.
  • ? for a NEUTRAL result interpreted like NONE (no policy).
  • ~ (tilde) for SOFTFAIL, a debugging aid between NEUTRAL and FAIL. Typically, messages that return a SOFTFAIL are accepted but tagged.
  • - (minus) for FAIL, the mail should be rejected (see below).

your hopeless using spf to filter on - its going to be neutral.. But sure there is something else you could filter on.. is the spam all coming from that IP? Got to be some key words to block.. Can you just report as spam, normally gmail updates their filtering.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Samsung Galaxy Z Fold 8, Flip 8, Z Fold Wide: Everything you need to know The ONLY thing I need to know is the price, which I know will be way higher than I (and most people) are willing to pay for a phone... so basically nothing here I need to know. PS: Nice job getting that Apple reference to a non-existent and unrevealed product as "competition" in there. Cheque is in the mail.
    • Well I really think the repasting helped if your higher clocks have returned, maybe the next thing to look at is if there is a problem with your case airflow? I guess this because your 3080 has returned to optimal state, but is still staying too warm, which might suggest it was thermal throttling before you repasted, of which the only logical conclusion could be outside factors.
    • Samsung Galaxy Z Fold 8, Flip 8, Z Fold Wide: Everything you need to know by Hamid Ganji Galaxy Z Fold 7 - Image via Samsung The next generation of Samsung foldables is set to be unveiled next month at the second Unpacked event of the year. Samsung’s 2026 foldables are not expected to offer significant upgrades over their predecessors, with the Korean firm instead focusing on design refinements and conventional upgrades such as faster processors and better cameras. However, Samsung is reportedly planning to unveil an all-new passport-style foldable this year to rival Apple’s first foldable iPhone, which is expected to debut this September. Here’s a roundup of everything we know about Samsung’s upcoming foldable devices ahead of their official debut. When can we expect Samsung’s new foldables? The Galaxy Z Fold 7 and Z Flip 7 series were unveiled in July, and Samsung is expected to maintain this timeframe in 2026. Based on previous reports from Korean sources, Samsung will hold its Unpacked event on July 22 in London, UK, to pull back the curtain on the Galaxy Z Fold 8 series. The devices are also expected to hit the shelves a few weeks after launch. However, Samsung has yet to announce an official date. A new naming scheme? One of the most interesting changes we might see this year is a new naming scheme for Samsung’s latest foldables. SamMobile reported that since Samsung is expected to unveil three foldables this year, it has adopted a new naming strategy to simplify product identification for customers. Accordingly, the standard Galaxy Z Fold 8 will reportedly be called the Galaxy Z Fold 8 Ultra and will serve as the direct successor to last year’s Galaxy Z Fold 7. The “Ultra” suffix suggests the phone could feature higher-end specifications, such as additional rear camera modules. Samsung’s new passport-style foldable is expected to carry the Galaxy Z Fold 8 name without any suffix. This model is reportedly equipped with two rear cameras. No major changes are expected for the Flip model. Galaxy Z Fold 8 Ultra and Z Flip 8 anticipated specs Rumors over the past few months suggest Samsung is preparing several upgrades for its upcoming foldables, although the devices may continue to rely on larger batteries and faster charging speeds rather than dramatic design changes. The primary focus this year is expected to be the Galaxy Z Fold 8 and its wide-screen design. Galaxy Z Fold 8 Ultra official CAD renders - Image via AndroidHeadlines Here are the anticipated specifications for the Galaxy Z Fold 8 Ultra based on previous leaks: 6.5-inch outer display and 8-inch inner display, 120Hz refresh rate, and 2,600 nits peak brightness Snapdragon 8 Elite Gen 5 processor, paired with 12GB or 16GB of RAM and 256GB, 512GB, or 1TB of storage 4.1mm thickness when unfolded and a weight of 210g 200MP main camera, 50MP ultrawide camera, 10MP or 12MP telephoto camera, 10MP cover camera, and 10MP selfie camera 5,000mAh battery with 45W wired charging Android 17 and One UI 9 As for the Galaxy Z Flip 8, the device is not expected to be a major departure from its predecessor, although it could become slightly slimmer. Expected specifications include: Snapdragon 8 Elite Gen 5 or Exynos 2600 processor 12GB of RAM with 256GB and 512GB storage options 6.9-inch Dynamic AMOLED 2X inner dispaly and 4.1-inch Super AMOLED outer dispaly 50MP main camera, 12MP ultrawide camera, and 10MP selfie camera 4,300mAh battery with 25W wired charging Android 17 and One UI 9 Samsung’s foldables are also expected to launch with Gemini Intelligence, Google’s AI suite for automating tasks in Android ecosystem. Moreover, given current memory and component costs, some Galaxy Z Fold 8 Ultra and Z Flip 8 variants could see a price hike. Galaxy Z Fold 8 adopts a wide-screen design The centerpiece of the upcoming Unpacked event could be the Galaxy Z Fold 8, previously rumored as the Galaxy Z Fold Wide. This model adopts a passport-style form factor and is expected to compete directly with Apple’s iPhone Fold. Galaxy Z Fold 8 official CAD renders - Image via AndroidHeadlines Here’s what to expect: 7.6-inch primary OLED display and 5.4-inch cover display, 120Hz refresh rate, 2,600 nits peak brightness, and 4:3 aspect ratio Snapdragon 8 Elite Gen 5 processor, 12GB or 16GB of RAM, and 256GB, 512GB, or 1TB storage options 4,800mAh battery with 45W wired charging 50MP main camera, 50MP ultrawide camera, and 10MP selfie camera Android 17 and One UI 9 The three new foldable phones are unlikely to be the only devices unveiled at Samsung’s Unpacked event. The company is also expected to introduce the Galaxy Watch Ultra 2 and the Galaxy Watch 9 series.
    • Thanks
  • Recent Achievements

    • Week One Done
      rolfus earned a badge
      Week One Done
    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
    • One Month Later
      agatameier earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      505
    2. 2
      +Edouard
      196
    3. 3
      PsYcHoKiLLa
      141
    4. 4
      ATLien_0
      89
    5. 5
      Steven P.
      81
  • Tell a friend

    Love Neowin? Tell a friend!