[185545] in North American Network Operators' Group
Re: Uptick in spam
daemon@ATHENA.MIT.EDU (Jutta Zalud)
Tue Oct 27 08:40:29 2015
X-Original-To: nanog@nanog.org
Date: Tue, 27 Oct 2015 13:40:24 +0100
From: Jutta Zalud <ju@netzwerklabor.at>
To: nanog@nanog.org
In-Reply-To: <CALeqL2exq_iLrVQWztJFD1EuiG+jdNgYpQjS2p8ZirH8UagZ_w@mail.gmail.com>
Errors-To: nanog-bounces@nanog.org
Am 27.10.2015 13:09, schrieb Ian Smith:
> On Mon, Oct 26, 2015 at 9:40 PM, Octavio Alvarez <octalnanog@alvarezp.org>
> wrote:
>
>> On 26/10/15 11:38, Jürgen Jaritsch wrote:
>> <snip>
>>
> But it is originating all from different IP addresses. Who knows if this
>> is an attack to get *@jdlabs.fr blocked from NANOG and is just getting
>> its goal accomplished.
>
>
>
> This is the part that's been bugging me. Doesn't the NANOG server
> implement SPF checking on inbound list mail? jdlabs.fr doesn't appear to
> have an SPF record published. It seems to me that these messages should
> have been dropped during the connection.
If it does (which I don't know), it will probably check the SPF record
of the delivering mailserver, which was not *.jdlabs.fr as far as I can
see from the mailheaders.
Jutta Zalud
