Print Page | Close Window

Another SPF Bug

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5264
Printed Date: 05 July 2025 at 12:48pm


Topic: Another SPF Bug
Posted By: pcmatt
Subject: Another SPF Bug
Date Posted: 14 July 2005 at 8:44am

Same latest version also does not work if domain only publishes "mx" identifier.

For example disney.com includes an mx only policy.  Email coming from any of it's mx servers like 192.195.66.21 are failed every time causing 100% false positive rate for legitimate disney.com email.

I must turn off SPF for now since too many errors.  Let me know when SPF works again.  Thanks for your quick attention to this.

-Matt

 

 



-------------
-Matt R


Replies:
Posted By: LogSat
Date Posted: 15 July 2005 at 7:08am
Matt, you're once more correct. We were able to replicate this, and saw that the bug has been there for quite some time, strange it was not caught before. We're working on a fix for this as well, it was not related to the one you reported the other day.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: pcmatt
Date Posted: 15 July 2005 at 10:13am

I had been noticing for some time that my back end log processing and spam investigating software was disagreeing with SpamFilter on some SPF issues, but I had not had time to debug and pinpoint the issue.  Thanks again for looking into this.

-Matt



-------------
-Matt R

Posted By: LogSat
Date Posted: 15 July 2005 at 7:30pm
Matt,

We pinpointed the problem. In the case of disney.com, there are multiple MX records:

disney.com      MX preference = 10, mail exchanger = mx3.disney.com
disney.com      MX preference = 10, mail exchanger = mx4.disney.com
disney.com      MX preference = 10, mail exchanger = mx1.disney.com
disney.com      MX preference = 10, mail exchanger = mx2.disney.com

Each one of these A records, in turn, resolves to multiple IP addresses for balancing, for example mx2.disney.com resolves to:

Name:    mx2.disney.com
Addresses:  192.195.66.21, 192.195.66.31, 204.128.192.26, 204.128.192.31

SpamFilter has always been checking the 1st IP address returned by the query, and was missing the other three. This is obviously a bug, and did not appear in prior testing as often the MX records points to a non-balanced A record.

We've fixed this behavior and are testing to ensure the patch is stable. Most likely we'll release the fix within the next 24/48 hours. If you wish to test if prior to that we'll be happy to make it available to you.

Again thanks for the help and support in finding the problem and reporting it to us.






-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window