Re: [courier-users] How did this pass SPF?

This is a MIME GnuPG-signed message. If you see this text, it means that
your E-mail or Usenet software does not support MIME signed messages.
The Internet standard for MIME PGP messages, RFC 2015, was published in 1996.
To open this message correctly you will need to install E-mail or Usenet
software that supports modern Internet standards.

--===============1544971863==
Content-Type: multipart/signed;
boundary="=_mimegpg-commodore.email-scan.com-13037-1209440868-0001";
micalg=pgp-sha1; protocol="application/pgp-signature"

This is a MIME GnuPG-signed message. If you see this text, it means that
your E-mail or Usenet software does not support MIME signed messages.
The Internet standard for MIME PGP messages, RFC 2015, was published in 1996.
To open this message correctly you will need to install E-mail or Usenet
software that supports modern Internet standards.

--=_mimegpg-commodore.email-scan.com-13037-1209440868-0001
Content-Type: text/plain; format=flowed; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Ben Kennedy writes:

> Hey all,
>=20
> I received a piece of spam tonight, to myself from myself (supposedly).=20
> I don't understand the SPF check: for the MAILFROM test, it indicates
> sender=3Dinfo@zyberphar.com (result "none"). However, the From: is
> clearly info@zygoat.ca, which would have failed since I have SPF record=
s
> for zygoat.ca.
>=20
> Where did the zyberphar.com domain come from?

The SMTP MAIL FROM command.

> I thought the MAILFROM
> SPF check matched against the From: field.

No, BOFHSPFMAILFROM checks the SMTP MAIL FROM command. BOFHSPFFROM checks=20
the From: field. The courier man page makes this distinction clear:

opt BOFHSPFMAILFROM=3Dkeywords
Use Sender Policy Framework to verify the return address i=
n the
MAIL FROM command sent by the connecting SMTP client. See
Sender Policy Framework Keywords below for a list of possi=
ble
keywords.

Note
No SPF checking is done for if the MAIL FROM command speci=
fies
an empty return address (a bounce). There=C2=B4s nothing t=
o check.

opt BOFHSPFFROM=3Dkeywords
Use Sender Policy Framework to verify the return address i=
n the
From: header. See Sender Policy Framework Keywords below f=
or
important information, and a list of possible keywords.



--=_mimegpg-commodore.email-scan.com-13037-1209440868-0001
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD4DBQBIFppkx9p3GYHlUOIRAlF3AJiBAx7WwGJTs9qsgGnsxQ 5ad/v+AJ4jBcOw
RHc8ESDJQrcD1hUM2/i0lg==
=o2SS
-----END PGP SIGNATURE-----

--=_mimegpg-commodore.email-scan.com-13037-1209440868-0001--


--===============1544971863==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
--===============1544971863==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
courier-users mailing list
courier-users@lists.sourceforge.net
Unsubscribe: https://lists.sourceforge.net/lists/.../courier-users

--===============1544971863==--