- NZNOG - lists.nznog.org

SPF Uptake in New Zealand
by Craig Whitmore 14 Jul '05

14 Jul '05

So you ask what is SPF? SPF (Sender Permitted From) is an anti-forgery method used with SMTP which stops people trying to send from your domain. Not designed for stopping spam, but helps reduce the amount of spam as well (stops people sending from other peoples domains). Spammers can add SPF records to their domains yes, (repeat: SPF doesn't stop spam but does a good job of it) but in the future may be improved to include trust factors (ie domain and SPF has been only around for 2 days and its sending 1000 emails to me... strange) There are quite a number of anti-forgery systems around at the moment, and the main ones are SPF, Sender-ID (Microsoft) and DomainKeys (Yahoo), SPF at the moment is the largest used worldwide. (over a million domain names having SPF records) The uptake in New Zealand is pretty small at the moment, but ISP's are starting to add SPF records for their domains. Xtra have added SPF rules for the xtra.co.nz Domain: v=spf1 ip4:210.86.15.0/24 ?all (host -t TXT xtra.co.nz) IHUG have added a SPF rule for ihug hosted domains to include: eg v=spf1 include:_spf.ihug.co.nz -all (host -t TXT _spf.ihug.co.nz) And a lot of Domains (see http://spam.co.nz/spf/working/) have started to add SPF Rules . This list is no where complete at the moment for .NZ (or other domainnames). Also quite a number of NZ domains have broken SPF records for various reasons which (if an ISP is testing for SPF will reject and cause bounces), so its quite important to make your rules correct (see http://www.spam.co.nz/spf/broken - This list is also quite imcomplete) I'm not saying SPF doesn't have its problems, but the major problem (at the moment) is forwarding emails . Ie user(a)ispa.com sends email to user(a)ispb.com and it gets forwarded to user(a)ispc.com. . If user(a)ispc.com checks for SPF it will fail as the user(a)ispa.com email address is coming from ISP B's email server. BUT mechanisms like SRS fix this problem. Mostly importantant is before SPF records are set up for a domain you must know how you users are using your domain. So maybe you think SPF is just something kids play around with and it will never be used for anything important and no one cares about it which is not so as its gaining momentum like just recently the IANA just gave SPF its own DNS RR (SPF) (see http://www.iana.org/assignments/dns-parameters) which will be used instead of the TXT records in the future to SPF records (maybe SPF v3 will use it only) More information can be read at: http://www.openspf.net/ and the mailing list and other information can be read at http://www.openspf.org/ Thanks Craig Whitmore www.spam.co.nz

9 11

RE: [nznog] SPF Uptake in New Zealand
by Nic Wise 14 Jul '05

14 Jul '05

> I'm guessing that this is a precursor to enforcing it for all > Microsoft controlled domains. Though presumably they will > have trouble enforcing it for Microsoft.com, unless they're > already prepping the next version of Exchange to include > spf/senderid support :) > I'm not 100% sure, but I think I read that this is going to be in Exchange 2003 SP2 - I think it's part of the "edge services" thing that's in SP2. Nic -- Nic Wise - Senior Developer - Microsoft MVP (.NET) AfterMail Limited. t. +64.21.676.418 w. http://www.aftermail.com/ e. nic.wise(a)aftermail.com b. http://www.fastchicken.co.nz/blog/

1 0

RE: [nznog] SPF Uptake in New Zealand
by Drew Broadley 14 Jul '05

14 Jul '05

> Just my 2c..... Nothing like a Friday morning rant... I need a V.... s/V/Beer/ ;) Cheers for that summary, it's helped me get my head around SPF, which I've flogged researching for the fear of adding False-Negatives possibilities on-top of my current SA setup (which, incidentally, has been flawless for a few months now). - Drew

1 0

RE: [nznog] SPF Uptake in New Zealand
by Simon Allard 13 Jul '05

13 Jul '05

> > If they set "v=spf1 ip4:210.86.15.0/24 -all" then some mail (for example > > that trademe.co.nz sends out) would get rejected as it would be coming > > from the wrong place > > > > This was a little unclear what I said . trademe.co.nz sends out emails > sometimes from the email address of the trademe user. If a user has email > address of customer(a)xtra.co.nz it will send from that address from trademe > mail server. and if tested for SPF with a -all will fail and get rejected. I can see SPF being a big learning curve to the NZ ISP customer base, once ISP's start enforcing SPF. We still see lots of email from customers who have an ispa email set as their email address but are using our email server because they moved ISP's but didn't want to change email address. I would be surprised if any ISP's don't see this. SPF seems like a very good idea, and will work perfectly for personal domains, but for big ISP's, xtra/clear/ihug etc. It's going to cause a huge influx of unhappy customers if it ever gets implemented. - Simon

2 1

RE: [nznog] SPF Uptake in New Zealand
by Nic Wise 13 Jul '05

13 Jul '05

Hey folks, Noone has mentioned building the SPF strings :) I found this a while back: http://www.anti-spamtools.org/SenderIDEmailPolicyTool/Default.aspx It's a nice little (online) wizard from MS, which allows you to build the string without having to work out a geekcode-look-alike. AFAIK, they don't store info - just show you the SPF for what you enter. No comment on how effective SPF might be, but the wizard is handy if you don't wanna work out the syntax :) Cheers. Nic, off to add the TXT record to his domains. -- Nic Wise - Senior Developer - Microsoft MVP (.NET) AfterMail Limited. t. +64.21.676.418 w. http://www.aftermail.com/ e. nic.wise(a)aftermail.com b. http://www.fastchicken.co.nz/blog/

4 6

RE: [nznog] SPF Uptake in New Zealand
by Drew Broadley 13 Jul '05

13 Jul '05

> Noone has mentioned building the SPF strings :) I found this a while > back: > > http://www.anti-spamtools.org/SenderIDEmailPolicyTool/Default.aspx > There is wizard on one of the one links posted by Craig. http://spf.pobox.com/ , http://www.openspf.net/ (some thing) The wizard is on the top left, where it says to enter your domain. - Drew

1 0

nz.pool.ntp.org??
by Simon 13 Jul '05

13 Jul '05

Hi There, Anyone know whats happened to this ntp server(s)? Im getting a connection timeout from a few days ago... # rdate -s nz.pool.ntp.org rdate: connect: Connection timed out Simon

3 3

RE: [nznog] nz.pool.ntp.org??
by Gavin Legge 13 Jul '05

13 Jul '05

Incidentally I tried nslookup on nz.pool.ntp.org a few minutes ago and it timed out. After the third or fourth attempt I got an answer with multiple IP's as expected. Hope that helps. -----Original Message----- From: Drew Broadley [mailto:drew(a)iws.co.nz] Sent: Thursday, 14 July 2005 9:12 a.m. To: nznog(a)list.waikato.ac.nz Subject: RE: [nznog] nz.pool.ntp.org?? > Hi There, Anyone know whats happened to this ntp server(s)? > Im getting a > connection timeout from a few days ago... > > # rdate -s nz.pool.ntp.org > rdate: connect: Connection timed out > > Simon I'm guessing you've tried multiple attempts ? Try a different nameserver in /etc/resolv.conf incase the one you're using has nutted out (for some unkonw reason) on the multiple A records ? - Drew _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. MailScanner Supplied by ITS-HelpDesk. ext 4001 or email helpdesk(a)irl.cri.nz-- This electronic transmission and any documents accompanying this electronic transmission contain confidential information belonging to the sender. This information may be legally privileged. The information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on or regarding the contents of this electronically transmitted information is strictly prohibited.

1 0

RE: [nznog] nz.pool.ntp.org??
by Drew Broadley 13 Jul '05

13 Jul '05

> Hi There, Anyone know whats happened to this ntp server(s)? > Im getting a > connection timeout from a few days ago... > > # rdate -s nz.pool.ntp.org > rdate: connect: Connection timed out > > Simon I'm guessing you've tried multiple attempts ? Try a different nameserver in /etc/resolv.conf incase the one you're using has nutted out (for some unkonw reason) on the multiple A records ? - Drew

1 0

RE: [nznog] nz.pool.ntp.org??
by Gavin Legge 13 Jul '05

13 Jul '05

Nope - but there is one at IRL - in fact the(one of many?) main reference for NZ. Msltime.irl.cri.nz enjoy -----Original Message----- From: Simon [mailto:dev(a)networker.co.nz] Sent: Thursday, 14 July 2005 9:00 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] nz.pool.ntp.org?? Hi There, Anyone know whats happened to this ntp server(s)? Im getting a connection timeout from a few days ago... # rdate -s nz.pool.ntp.org rdate: connect: Connection timed out Simon _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. MailScanner Supplied by ITS-HelpDesk. ext 4001 or email helpdesk(a)irl.cri.nz-- This electronic transmission and any documents accompanying this electronic transmission contain confidential information belonging to the sender. This information may be legally privileged. The information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on or regarding the contents of this electronically transmitted information is strictly prohibited.

1 0