I'm seeing a problem here.

Hotmail will come in and pass the spf tests, but it gets blocked by a dns blacklist.

I"m thinking there should be some way around this. IE. If the spf passes, it should skip the dns lookup?

Something along those lines.

Yikes, you're right!  I just checked my logs and some hotmail.com stuff is blocked by SORBS. I.E. http://www.dnsbl.sorbs.net/lookup.shtml?65.54.187.52" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.dnsbl.sorbs.net/lookup.shtml?65.54.187.52" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://www.dnsbl.sorbs.net/lookup.shtml?65.54.187.52

SpamFilter is just doing it's job.  No current support for having SPF override other failures.  We can either whitelist their servers, whitelist the senders or wait until Hotmail gets de-listed.

-Matt

Kevin,

I temporarily added the IP's from Hotmail.com's SPF record to my From IP Whitelist:

209.240.192.*
65.52.*
131.107.*
157.54.*
157.56.*
157.60.*
167.220.*
204.79.135.*
204.79.188.*
204.79.252.*
207.46.*
199.2.137.*

That should get the Hotmail through until they get de-listed. 

-Matt

I checked the actual IP's that were getting blocked due to MAPS listing, since 12/01/2004 using my log file reporting software, and this is the list that I have:

64.4.35.22
64.4.16.68
64.4.22.83
64.4.53.70
65.54.185.13
65.54.245.20
65.54.245.21
65.54.187.52

Much better to whitelist the actual list instead of the globals I gave you earlier.  It would be nice if SpamFilter could allow us to specify the actual subnet (ie http://openrbl.org/whois?i=64.4.0.0&f=2" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - 64.4.0.0 /18)  Because obviously Hotmail.com does not have every 64.4.* address. 

Honestly, although there have been times I thought it would be nice to have, I don't consider the inabilility to whitelist odd subnets very necessary.  Most whitelisting we do is a class c or a single IP so the current methods work just fine.

-Matt

Kevin, et al,

I just looked at the last 1000 of the blocked messages "From *@hotmail.com" and really do not see any that look like they should not have been blocked.  Are you really seeing bunches?

Dan S.

Keep in mind that hotmail may have had some difficulty with hit and run spammers, but the problem was spanning days and wanted email was getting blocked.  If you don't use dnsbl.sorbs.net for MAPS then you wouldn't have seen any problems.

I verified the problem by querying just MAPS rejections from hotmail.com hostnames in December.  That's how I got the list of specific IP's for hosts blocked by dnsbl.sorbs.net that I posted.  Other hotmail hosts could be blacklisted by dnsbl.sorbs.net and just had not been used to send to my users. 

These are the hostnames for the IP's I had posted, all good hotmail.com servers:

-Matt