Spam Filter ISP Forums : SPF return unknown https://www.logsat.com/spamfilter/forums/ Sun, 19 Jul 2026 07:58:57 +0000 Wed, 06 Oct 2010 19:13:34 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6879 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[SPF return unknown : Yes a smart spammer will not pick...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6879&PID=13821&title=spf-return-unknown#13821 Author: yapadu
Subject: 6879
Posted: 06 October 2010 at 7:13pm

Yes a smart spammer will not pick a domain with valid SPF rules, a much higher % of spam will be stopped when a domain publishes SPF.

By publishing SPF records the domain owner is protecting themselves from spammers trying to forge email from their domain.

It is almost like a lock on a bike or house.  Just because you have a lock does not mean you can't get broken into but a thief is probably just going to hit the house next door that does not have an alarm.

Thanks for the new release Roberto, a couple of nice new additions in there!
]]> Wed, 06 Oct 2010 19:13:34 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6879&PID=13821&title=spf-return-unknown#13821 <![CDATA[SPF return unknown : ok ... If I understand well,...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6879&PID=13820&title=spf-return-unknown#13820 Author: vbourbeau
Subject: 6879
Posted: 06 October 2010 at 8:06am

ok ...
 
If I understand well, wise spamer can use domain name who don't respect the SPF RFC and bypass most of the SPF rules.
]]> Wed, 06 Oct 2010 08:06:45 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6879&PID=13820&title=spf-return-unknown#13820 <![CDATA[SPF return unknown : SpamFilter will return an &#034;unknown&#034;...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6879&PID=13818&title=spf-return-unknown#13818 Author: LogSat
Subject: 6879
Posted: 05 October 2010 at 10:42pm

SpamFilter will return an "unknown" if the SPF record is malformed, and will skip the SPF filter check to avoid blocking valid emails.

As a side-note, in your specific example, hallmark.com does indeed have what appears as an improperly formatted SPF record, since it contains two v=spf1 mechanisms:

hallmark.com.           1       IN      TXT     "v=spf1 ip4:208.1.139.0/24 ip4:129.33.92.0/24 ip4:65.116.50.141 ip4:65.116.50.144 ip4:65.116.50.142 ip4:65.116.50.143 ip4:162.94.28.0/24 v=spf1 ip4:209.176.191.124 ip4:209.176.191.121 ip4:209.176.191.123 ip4:209.176.191.122 ip4:193.132.80.20 mx ~all"

while this does appear to violate the SPF RFC, we do see that the online verifier for openspf.org themselves marks that SPF record as legitimate. Due to this, we've just uploaded int he registered user area an updated build of SpamFilter (4.2.4.836) that ignores the duplicate v=spf1 mechanisms and continues to validate the remaining of the SPF record for further analysis.
]]> Tue, 05 Oct 2010 22:42:04 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6879&PID=13818&title=spf-return-unknown#13818 <![CDATA[SPF return unknown : Hi Lot of spam pass spamfilter...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6879&PID=13817&title=spf-return-unknown#13817 Author: vbourbeau
Subject: 6879
Posted: 05 October 2010 at 2:23pm

Hi
 
Lot of spam pass spamfilter and when I look in log the SPF result return "unknown". What mean this result?
 
The spam is clearly not the domain owners. Example: e-cards@hallmark.com with 65.166.169.23
 
]]> Tue, 05 Oct 2010 14:23:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6879&PID=13817&title=spf-return-unknown#13817