[160701] in North American Network Operators' Group
Re: Ok: this is a targetted attack
daemon@ATHENA.MIT.EDU (Sean Lazar)
Mon Feb 11 16:39:38 2013
Date: Mon, 11 Feb 2013 13:39:18 -0800
From: Sean Lazar <knife@toaster.net>
To: Jay Ashworth <jra@baylink.com>
In-Reply-To: <27912468.5751.1360599594680.JavaMail.root@benjamin.baylink.com>
Cc: NANOG <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Jay, you need to have SPF records for your domain. This will prevent the
spoofing you are seeing.
http://en.wikipedia.org/wiki/Sender_Policy_Framework
$ dig @8.8.8.8 baylink.com TXT
; <<>> DiG 9.8.3-P1 <<>> @8.8.8.8 baylink.com TXT
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11443
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;baylink.com. IN TXT
;; AUTHORITY SECTION:
baylink.com. 194 IN SOA localhost. jra.baylink.com.
2011032901 28800 14400 86400 600
;; Query time: 39 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Feb 11 13:36:33 2013
;; MSG SIZE rcvd: 78
Sean
On 2/11/13 8:19 AM, Jay Ashworth wrote:
> Clearly, someone has decided to shoot at me specifically, since this
> latest spam supposedly from me:
>
> =====
> Received: from lpb01.clearspring.com ([206.165.250.240]
> helo=lpb01-a.clearspring.local)
> by sc1.nanog.org with esmtp (Exim 4.80 (FreeBSD))
> (envelope-from <email@addthis.com>) id 1U4vc3-000Cq4-9q
> for nanog@nanog.org; Mon, 11 Feb 2013 15:48:11 +0000
> Received: from lpb01.clearspring.local (localhost [127.0.0.1])
> by lpb01-a.clearspring.local (8.14.4/8.14.4) with ESMTP id r1BFm5bG022255
> for <nanog@nanog.org>; Mon, 11 Feb 2013 10:48:05 -0500
> Date: Mon, 11 Feb 2013 10:48:05 -0500
> From: jra@baylink.com
> To: nanog@nanog.org
> Message-ID: <57414784.191289.1360597685530.JavaMail.brainiac@lpb01.clearspring.local>
> =====
>
> is also about FTTH.
>
> FOR THE RECORD: I don't ever use "send this link to someone", and especially
> not to a mailing list; this isn't even my tenth rodeo.
>
> Cheers,
> -- jr 'DoS attack? What's that?' a