Print Page | Close Window

SPF and hotmail.com

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4523
Printed Date: 02 July 2025 at 3:06am


Topic: SPF and hotmail.com
Posted By: Guests
Subject: SPF and hotmail.com
Date Posted: 05 November 2004 at 6:59am

I am experiencing lot's of SPF blockings on the hotmail.com domain - is it M$ who dont know how to configure a the SPF record or just me ?

Greetings, Allan


Replies:
Posted By: Guests
Date Posted: 05 November 2004 at 7:50am

YES!!  Same thing here!!

I am seeing Hotmail addresses being blocked due to SPF.  It started to the best of my knowledge in the last week or so.

 

Posted By: Desperado
Date Posted: 05 November 2004 at 10:07am

Hmmm ... in the last 8 hours I have 326 SPF blocks wit a hotmail address but I do not see a single one that should not have been blocked.  The have strange records that may not be able to be interpreted by SpamFilter versions before 388.  What version are you running?

Dan S.

Posted By: Guests
Date Posted: 05 November 2004 at 10:49am

I'm running 385...

Below is example from log:

11/05/04 08:55:58:440 -- (2312) Connection from: 65.54.171.5 - Originating country : United States

11/05/04 08:55:58:644 -- (2312) Resolving 65.54.171.5 - bay4-f5.bay4.hotmail.com

11/05/04 08:55:58:690 -- msn.com is a domain, searching for SPF record

11/05/04 08:55:58:690 -- (2312) - SPF record for msn.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:737 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for msn.com done: - softfail

11/05/04 08:55:58:753 -- (2312) failed SPF test (softfail) - Disconnecting 65.54.171.5

11/05/04 08:55:58:753 -- (2312) 65.54.171.5 - Mail from: tstruyk@msn.com To: bena@gocolumbiamo.com will be rejected

11/05/04 08:55:58:894 -- (2312) Disconnect

Posted By: LogSat
Date Posted: 05 November 2004 at 11:19am

Try 388 at http://www.logsat.com/pub/sf/rv200/SF2.1.1.388.zip" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.logsat.com/pub/sf/rv200/SF2.1.1.388.zip" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.logsat.com/pub/sf/rv200/SF2.1.1.388.zip" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - ***EDITED BY LOGSAT SUPPORT - please download latest pre-release builds by logging in the registered are of the website***

See notes below:

// New to VersionNumber = '2.1.1.388';
{TODO -cFix : Fixed SPF bug introduced in build 386 - SPF queries had incorrect "none" results}
{TODO -cFix : whitelisted emails were forwarded to alternate dest SMTP server if using option new in build 387}

// New to VersionNumber = '2.1.1.387';
{TODO -cNew : Added SpamFilter.ini option to forward email tagged as SPAM to an alternate destination SMTP server}

// New to VersionNumber = '2.1.1.386';
{TODO -cNew : Modified SPF lookups to search for SPF TXT record even if hostname is not a domain}

Dan S.

Posted By: Guests
Date Posted: 05 November 2004 at 11:49am

388 Works...

Any idea when this will released as a production version?

Posted By: Desperado
Date Posted: 05 November 2004 at 12:05pm

No ... ask mailto:support@logsat.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - support@logsat.com .   Why, are you worried about the stability?  I am running 388 in all my instalations with no problems that I have seen.

But ... you say this fixed your issue?

Dan S.

Posted By: BigDog
Date Posted: 05 November 2004 at 12:27pm

Yes, hotmail mail is now being accepted....  It would appear that MS decided  just didn't publish their hotmail spf dns records properly;  It's apparently not necessarly SpamFilter's flaw as much as Hotmail's inablity to just follow the SPF rules properly.

http://archives.listbox.com/spf-discuss@v2.listbox.com/200411/0085.html" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://archives.listbox.com/spf-discuss@v2.listbox.com/200411/0085.html" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://archives.listbox.com/spf-discuss@v2.listbox.com/200411/0085.html

 

I am always too conservitive, I want others to find the bugs....  :) 


Posted By: BigDog
Date Posted: 12 November 2004 at 10:26am

Yes stablity is an issue, for the first time ever I lost incoming email yesterday after running the prerelease version.

All hell broke loose at 2:46 PM yesterday...  here's the log...  (this is why I don't like "pre-release" 

Let the stunt men get "on the plane", I'm riding "In the plane"!!!

11/11/04 14:46:40:354 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:40:542 -- (2748) Exception occurred during DoDeleteExpiredQuarantineList: System resource exceeded

11/11/04 14:46:40:542 -- (676) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 96 97 111) Unspecified error

11/11/04 14:46:40:542 -- (676) Disconnect

11/11/04 14:46:40:542 -- (568) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 21 23 24 25 26 27 28 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 96 97 111) Unspecified error

11/11/04 14:46:40:542 -- (2868) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 21 23 24 25 26 27 28 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 96 97 111) Unspecified error

11/11/04 14:46:40:542 -- (568) Disconnect

11/11/04 14:46:43:048 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:43:988 -- (3788) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 96 97 111) System resource exceeded

11/11/04 14:46:43:988 -- (3788) Disconnect

11/11/04 14:46:45:617 -- (2868) Disconnect

11/11/04 14:46:48:436 -- (1084) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 96 97 111) Not enough storage is available to complete this operation

11/11/04 14:46:48:436 -- (1084) Disconnect

11/11/04 14:46:49:627 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:49:627 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:51:851 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:57:960 -- (2660) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 96 97 111) System resource exceeded

11/11/04 14:46:57:960 -- (3144) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 96 97 111) Could not convert variant of type (Null) into type (Integer)

11/11/04 14:46:57:960 -- (2660) Disconnect

11/11/04 14:46:57:960 -- (2172) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 96 97 111) System resource exceeded

11/11/04 14:46:57:960 -- (2172) Disconnect

11/11/04 14:46:57:960 -- (3144) Disconnect

11/11/04 14:47:03:865 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:22:960 -- (196) EMail from antifraud.ref.num577528@suntrust.com to SES@ci.columbia.mo.us was received and quarantined. Size: 14 KB, 14336 bytes

11/11/04 14:47:22:960 -- (196) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:23:007 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:47:23:022 -- (196) Disconnect

11/11/04 14:47:23:618 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:31:982 -- (772) Error occurred while checking for new build

11/11/04 14:47:35:616 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:37:449 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:40:206 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:41:005 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:43:433 -- (3708) EMail from error-1-36315546-2244-663721@r.expertsavings.com to ckmccoll@gocolumbiamo.com was received and quarantined. Size: 2 KB, 2048 bytes

11/11/04 14:47:43:433 -- (3708) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:43:480 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:47:43:495 -- (3708) Disconnect

11/11/04 14:47:45:156 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:46:910 -- (3740) EMail from sorogers@OUTGOING82.myredemail.com to ajb@ci.columbia.mo.us was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:47:46:910 -- (3740) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:46:973 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:47:46:988 -- (3740) Disconnect

11/11/04 14:47:47:286 -- (1868) EMail from sorogers@OUTGOING82.myredemail.com to ajb@ci.columbia.mo.us was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:47:47:286 -- (1868) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:47:349 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:47:47:364 -- (1868) Disconnect

11/11/04 14:47:50:685 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:51:782 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:55:149 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:48:59:152 -- (2916) EMail from ourcsjibm@garfield.com to hr@gocolumbiamo.com, hrc@gocolumbiamo.com was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:48:59:152 -- (2916) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:48:59:199 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:48:59:215 -- (2916) Disconnect

11/11/04 14:49:38:328 -- (3216) EMail from mcallahan_uf@moensters.de to em@gocolumbiamo.com was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:49:38:328 -- (500) EMail from dhurstxl@stanley.co.jp to jbm@ci.columbia.mo.us was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:49:38:328 -- (3216) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:49:38:328 -- (500) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:49:38:328 -- (1024) EMail from valentin_beard_pt@orion.toppoint.de to clr@gocolumbiamo.com was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:49:38:328 -- (1024) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:49:38:375 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:49:38:406 -- (500) Disconnect

11/11/04 14:49:38:406 -- (3216) Disconnect

11/11/04 14:49:38:406 -- (1024) Disconnect

11/11/04 14:49:38:422 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:49:38:453 -- (2792) Time to add Msg to Bayes corpus:0

Posted By: Guests
Date Posted: 05 January 2005 at 5:34pm

Ok..now I'm getting softfail SPF errors with hotmail.com:

01/05/05 10:41:21:651 -- (3388) Connection from: 64.4.56.27  -  Originating country : United States
01/05/05 10:41:27:939 -- (3388) Resolving 64.4.56.27 - bay101-f17.bay101.hotmail.com
01/05/05 10:41:33:006 -- (3388) found SPF record: v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all
01/05/05 10:41:38:003 -- (3388) - SPF analysis for spf-a.hotmail.com done: - none
01/05/05 10:41:38:003 -- Warning: Error during SPF record check - TimedOut
01/05/05 10:41:48:016 -- (3388) - SPF analysis for spf-c.hotmail.com done: - none
01/05/05 10:41:48:016 -- Warning: Error during SPF record check - TimedOut
01/05/05 10:41:53:013 -- (3388) - SPF analysis for spf-d.hotmail.com done: - none
01/05/05 10:41:53:013 -- Warning: Error during SPF record check - TimedOut
01/05/05 10:41:53:013 -- (3388) SPF query result:
01/05/05 10:41:53:013 -- (3388) - SPF analysis for hotmail.com done: - softfail
01/05/05 10:41:53:013 -- (3388) failed SPF test (softfail) - Disconnecting 64.4.56.27

This is in version .395 and I'm not having this issue with any other domain.  Is hotmail.com just messing up there own SPF record or what?

Posted By: LogSat
Date Posted: 12 January 2005 at 9:57am
Fred,

Are you seing other instances of the softfail from hotmail, or is that the only example you found in the logs? If there's more, could you please post those as well?

What we believe is happening is that hotmail specified several sub-domains to include in the DNS query, and each is to be in turn queried. While some will softfail because, if the IP is legitimate eventuallyone of them will result in a "pass". SpamFilter will ignore all fails and softfails should a pass be found. However in your sample we see several timeouts, possibly occurring on the domain that does pass. If so, this may be a bug, as timeouts should not be causing a test to fail.

Roberto F. LogSat Software

Posted By: Guests
Date Posted: 12 January 2005 at 11:26am

Yes, it's happening frequently with hotmail.com transmissions that look legit based upon the reverse DNS results, etc.  I will go through our logs and post them later today as well as for another domain that is doing the same thing (can't remember off the top of my head).

Also, we are going to be purchasing our registered version of spamfilter today...woohoo!  The ability to automatically process forced delivery attempts will definetly be a warm welcome and save me work that is starting to grow exponentially with manually doing forced deliveries.

Thank you guys for all your support and for allowing users to use all the features, save the automated forced delivery feature without having to make an upfront purchase.


Print Page | Close Window