Problem with Ebay and SPF
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4473
Printed Date: 10 May 2025 at 3:43pm
Topic: Problem with Ebay and SPF
Posted By: kspare
Subject: Problem with Ebay and SPF
Date Posted: 24 October 2004 at 1:14pm
|
Is there stuff just not setup properly? No wonder since they turned on spf I haven't been getting my ebay stuff!
10/24/04 11:00:20:812 -- (2728) Connection from: 66.135.197.24 - Originating country : United States |
Replies:
Posted By: LogSat
Date Posted: 25 October 2004 at 1:31am
|
Kevin, EBay is running into the same problem another user reported http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=4460" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - here ( http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=4460" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=4460" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=4460 ). ebay.ca SPF record contains include directives which tell the SPF filter to retrieve further information from ebay's subdomains: "v=spf1 mx include:m._spf.ebay.com include:s._spf.ebay.com include:c._spf.ebay.com include:p._spf.ebay.com ~all" The problem is that the subdomains specified are not really domains: m._spf.ebay.com but just entries under the _spf.ebay.com domain. The RFC states that SPF records are to be retrieved from a "DOMAIN", not a host record. All the 4 entries above are *not* domains, so even though they have an SPF record, it's not supposed to be queried. This means that ebay.ca and ebay.com have an invalid spf confguration. However I checked the domain using the tolls that http://spf.pobox.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://spf.pobox.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://spf.pobox.com provides, and they do say that the domain complies (against their own rules...) We've been seing more and more domains that, while incorrectly configured, are marked as "good" by SPF checkers. We'll be doing research to see how we should proceed. Roberto F. |
Posted By: nippe
Date Posted: 25 October 2004 at 6:28am
|
We are not using the same tools. I can see that ebay.com has TXT/spf-records but can not find any TXT-records at all for _spf.ebay.com. And i can also see that the "maybe-domains" do have TXT/spf-records. Yes, it looks like the same problem I have with skutan.smf.se. |
Posted By: nippe
Date Posted: 25 October 2004 at 7:28am
|
Sorry! I did not test before my last comment. I have now put in a record for notinuse.smf.se. (A TXT-record in smf.se.) notinuse TXT v=spf1 ip4:193.15.18.0/24 -all The TXT-record for "notinuse" is NOT showing up as a TXT-record in the domain smf.se when asking from "outside". I have to ask for TXT-record in the "domain" notinuse.smf.se to se that record. ... notinuse.smf.se is not at domain. :) |
Posted By: nippe
Date Posted: 26 October 2004 at 10:11am
|
You wrote: We've been seing more and more domains that, while incorrectly configured, are marked as "good" by SPF checkers. We'll be doing research to see how we should proceed. Here you can find a test tool from Microsoft: Microsoft do not have to be right - they are big. :-) |
Posted By: LogSat
Date Posted: 27 October 2004 at 9:56pm
| Kevin,Even though it apparently is against the SPF guidelines, we are noticing several domains being "misconfigured" that are reported as having valid SPF records by various SPF implementations.At this point we decided to "go with the flow", and relax our implementation of SPF a little, marking as valid SPF records for hostnames that are not proper domains. We made available for download in the registered user area pre-release build 2.1.1.386 that has these changes.Roberto F. LogSat Software |
Posted By: Guests
Date Posted: 19 October 2005 at 4:33pm
|
kspare wrote:Posted By: LogSat
Date Posted: 19 October 2005 at 6:03pm
|
Kevin, What version of SpamFilter are you using? We tried the latest build, 2.6.3.488 and it appears to process the SPF record for ebay.ca correctly: 10/19/05 17:57:46:218 -- (2968) Connection from: 66.135.197.24 - Originating country : N/A 10/19/05 17:57:46:375 -- (2968) Resolving 66.135.197.24 - Not found 10/19/05 17:58:13:359 -- (2968) found SPF record for ebay.ca: v=spf1 mx include:s._spf.ebay.com include:m._spf.ebay.com include:p._spf.ebay.com include:c._spf.ebay.com ~all 10/19/05 17:58:13:500 -- (2968) found SPF record for s._spf.ebay.com: v=spf1 ip4:66.135.209.192/27 ip4:66.135.197.0/27 ip4:64.4.240.64/27 ip4:64.4.244.64/27 ~all 10/19/05 17:58:13:515 -- (2968) SPF query result: pass 10/19/05 17:58:13:515 -- (2968) - SPF analysis for s._spf.ebay.com done: - pass 10/19/05 17:58:13:515 -- (2968) SPF query result: pass 10/19/05 17:58:13:515 -- (2968) - SPF analysis for ebay.ca done: - pass We also tried using the "Test SPF" function under the "Settings - SPF Filter" tab, using the IP of 66.135.197.24 and email of bidconfirm@ebay.ca, and that too correctly validates the SPF record: 10/19/05 17:52:49:906 -- found SPF record for ebay.ca: v=spf1 mx include:s._spf.ebay.com include:m._spf.ebay.com include:p._spf.ebay.com include:c._spf.ebay.com ~all 10/19/05 17:52:50:531 -- found SPF record for s._spf.ebay.com: v=spf1 ip4:66.135.209.192/27 ip4:66.135.197.0/27 ip4:64.4.240.64/27 ip4:64.4.244.64/27 ~all 10/19/05 17:52:50:531 -- SPF query result: pass 10/19/05 17:52:50:531 -- - SPF analysis for s._spf.ebay.com done: - pass 10/19/05 17:52:50:531 -- SPF query result: pass 10/19/05 17:52:50:531 -- - SPF analysis for ebay.ca done: - pass Result: pass Could you try the latest build to see if it solves the problem? There have been several SPF bug fixes prior to the latest build, and one of those might be causing the problem. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |