Spam Filter ISP Forums : Error in process of SPF EXISTS? https://www.logsat.com/spamfilter/forums/ Sat, 07 Mar 2026 16:05:47 +0000 Wed, 04 May 2011 04:21:34 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6940 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Error in process of SPF EXISTS? : First of, I have solved my problem....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14068&title=error-in-process-of-spf-exists#14068 Author: psamsig
Subject: 6940
Posted: 04 May 2011 at 4:21am

First of, I have solved my problem. I upgraided to 844 and that didn't help, and since you couldn't reproduce the problem with either 834 and 844, it had to come from somewhere else, and the only other place was my DNS server. It seems that it got upgraided at some point and had a new default 'feature' to filter out 127.0.0.1 (amongst other internal subnets) responses from external servers,  great feature for some, but poison in this context.

Just for the recprd, the output didn't have a 'threadID' since it was copy/paste from the very tiny output field in beside the 'Test SPF' box.

Thank you very much for your support, it has been very helpfull!

/pds
]]> Wed, 04 May 2011 04:21:34 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14068&title=error-in-process-of-spf-exists#14068 <![CDATA[Error in process of SPF EXISTS? : psamsig,We had tested by sending...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14066&title=error-in-process-of-spf-exists#14066 Author: LogSat
Subject: 6940
Posted: 04 May 2011 at 12:51am

psamsig,

We had tested by sending an actual email faking the IP to be 192.66.33.189. I ran a test using the "Test SPF" button, using both SpamFilter 4.2.4.844 and 4.2.4.834. In both cases the result is "pass" - I included a screenshot so you can see (I manually inserted word-wraps in the result to make it more visible). The actual line there reads:

05/04/11 00:23:16:843 -- - SPF analysis for tdc.dk done: - pass

What is a bit strange is your output in your last post on 5/2/11 00:11:59 is missing a (threadID) value, meaning that it wasn't the result of an incoming email. It was thus likely the result of the SPF test. That output however is not sent to the activity logfile/screen by those two versions of SpamFilter - the SPF test result appears only on one line in the result window. This type of logging was occurring on very old versions of SpamFilter instead. Are you absolutely certain you are using SpamFilter v4.2.4.434, and not an earlier version? Could you please email us at support @ logsat.com with a screenshot of your SpamFilter showing the "Test SPF" button and the failure results?



]]> Wed, 04 May 2011 00:51:16 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14066&title=error-in-process-of-spf-exists#14066 <![CDATA[Error in process of SPF EXISTS? : I just checked, and if I try with...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14063&title=error-in-process-of-spf-exists#14063 Author: psamsig
Subject: 6940
Posted: 01 May 2011 at 6:23pm

I just checked, and if I try with the above mentioned information (xxx@tdc.dk sending from 192.66.33.189), the 'Test SPF' in Spam Filter still gives a softfail

05/02/11 00:11:59:763 -- found SPF record for tdc.dk: v=spf1 exists:%{i}.spf.tdc.dk include:spf.w11.dk ~all
Result: softfail
05/02/11 00:11:59:841 -- found SPF record for spf.w11.dk: v=spf1 ip4:195.69.128.114 ip4:195.69.128.115 ip4:195.69.128.116 ip4:195.69.128.118 ip4:195.69.128.121 ip4:195.69.128.122 ip4:86.58.131.176 -all
05/02/11 00:11:59:841 -- SPF query result: fail
05/02/11 00:11:59:841 -- - SPF analysis for spf.w11.dk done: - fail
05/02/11 00:11:59:841 -- SPF query result: softfail
05/02/11 00:11:59:841 -- - SPF analysis for tdc.dk done: - softfail

and since the exists part isn't even mentioned in the log, it still leads me to suspect that it isn't being proccessed, especially since it is that rule that should make it pass.

Do you get a different output than me?

/pds
]]> Sun, 01 May 2011 18:23:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14063&title=error-in-process-of-spf-exists#14063 <![CDATA[Error in process of SPF EXISTS? : psamsig,The build 4.2.4.844 is...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14062&title=error-in-process-of-spf-exists#14062 Author: LogSat
Subject: 6940
Posted: 01 May 2011 at 4:48pm

psamsig,

The build 4.2.4.844 is a pre-release build that is available for registered users , even though it's our release candidate that is actually scheduled to be released officially tonite - excellent timing :-)

We compared the SPF features in both 4.2.4.844 and 4.2.4.834, and they are identical, except for a bug fix in 4.2.4.844 which addresses cases where a domain has (incorrectly) configured more than one SPF record in DNS (which is not the case here). The way the "exists:" mechanism, and the %{i} macro are handled appear identical, so I do not think upgrading should fix the issue.
]]> Sun, 01 May 2011 16:48:34 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14062&title=error-in-process-of-spf-exists#14062 <![CDATA[Error in process of SPF EXISTS? : We are running v4.2.4.834, which...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14061&title=error-in-process-of-spf-exists#14061 Author: psamsig
Subject: 6940
Posted: 01 May 2011 at 12:40pm

We are running v4.2.4.834, which I thought was the latest build (according to the program it self), I'll try upgraid as soon as I figure out if we still have maintenance.

Thank you for a quick answer.

/pds
]]> Sun, 01 May 2011 12:40:01 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14061&title=error-in-process-of-spf-exists#14061 <![CDATA[Error in process of SPF EXISTS? : psamsig,We&#039;re not able to...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14060&title=error-in-process-of-spf-exists#14060 Author: LogSat
Subject: 6940
Posted: 30 April 2011 at 2:06pm

psamsig,

We're not able to reproduce this - SpamFilter is correctly accepting the SPF record "v=spf1 exists:%{i}.spf.tdc.dk include:spf.w11.dk ~all" when the sender's IP is 192.66.33.189.

The result of that SPF record depends on the existence of an A record for:
192.66.33.189.spf.tdc.dk
which does exist (at least it does today) and resolves to 127.0.0.1.

Are you still having this issue today? In theory it could be possible that 192.66.33.189.spf.tdc.dk did not resolve to anything yesterday which is why the email would have been blocked.

Just to make sure there isn't an unknown bug in earlier versions of SpamFilter, could you let us know what build of SpamFilter you're using? We verified this record to work as expected with SpamFilter v4.2.4.844.
]]> Sat, 30 Apr 2011 14:06:46 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14060&title=error-in-process-of-spf-exists#14060 <![CDATA[Error in process of SPF EXISTS? : I block SPF softfails and had...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14059&title=error-in-process-of-spf-exists#14059 Author: psamsig
Subject: 6940
Posted: 29 April 2011 at 5:34am

I block SPF softfails and had this one getting blocked today. According to http://www.openspf.org/Why it shouldn't have been, i suspect it is the EXISTS that isn't handled correct?

/pds

04/29/11 10:14:25:094 -- (8380) Detected TCP Connection: 192.66.33.189
04/29/11 10:14:25:094 -- (8380) Connection from: 192.66.33.189  -  Originating country : Denmark
04/29/11 10:14:25:297 -- (8380) Received MAIL FROM: <xxx@tdc.dk>
04/29/11 10:14:25:297 -- (8380) Received RCPT TO: yyy@mycompany.tld
04/29/11 10:14:25:500 -- (8380) found SPF record for tdc.dk: v=spf1 exists:%{i}.spf.tdc.dk include:spf.w11.dk ~all
04/29/11 10:14:25:625 -- (8380) found SPF record for spf.w11.dk: v=spf1 ip4:195.69.128.114 ip4:195.69.128.115 ip4:195.69.128.116 ip4:195.69.128.118 ip4:195.69.128.121 ip4:195.69.128.122 ip4:86.58.131.176 -all
04/29/11 10:14:25:625 -- (8380) SPF query result: fail
04/29/11 10:14:25:625 -- (8380) - SPF analysis for spf.w11.dk done: - fail
04/29/11 10:14:25:625 -- (8380) SPF query result: softfail
04/29/11 10:14:25:625 -- (8380) - SPF analysis for tdc.dk done: - softfail
04/29/11 10:14:25:625 -- (8380) failed SPF test (softfail) - Disconnecting 192.66.33.189
04/29/11 10:14:25:625 -- (8380) 192.66.33.189 - Mail from: xxx@tdc.dk To: yyy@mycompany.tld will be disconnected
04/29/11 10:14:25:657 -- (8380) Blacklist cache - Added 192.66.33.189 to limbo
04/29/11 10:14:25:657 -- (8380) Disconnect
]]> Fri, 29 Apr 2011 05:34:13 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6940&PID=14059&title=error-in-process-of-spf-exists#14059