GFI
English Deutsch Français Italiano Nederlands Español
Forums  Register  Login  My Profile  Inbox  Address Book  My Subscription  My Forums 

Member List  Search  FAQ  Ticket List  Log Out

 

SPF picking up return path instead of from address

  		Logged in as: Guest
Users viewing this topic: none
  Printable Version
All Forums >> [Content Security] >> GFI MailEssentials for Exchange/SMTP >> SPF picking up return path instead of from address Page: [1]
Login
Message << Older Topic   Newer Topic >>
SPF picking up return path instead of from address - 3.Sep.2008 2:40:17 PM   
joestern

 

Posts: 236
Joined: 18.Sep.2003
From: Philadelphia, PA
Status: offline 		A user I support is an officer in an industry association. The e-mails sent on behalf of this association are getting blocked by SPF. It appears that MailEssentials is looking up the SPF record for the Return_Path address in the e-mail header and not the SMTP from address. This seems odd to me.

Here's the log entry for a blocked message:
quote:

"09/03/08 11:58:43","SPF","sendstudio_bounces@synergynews.info","jdoe@mycorp.com","The 2008 Institute Meeting: General Session Highlights","Moved to V:\SPFdump\sendstudio_bounces@synergynews.info_jdoe@mycorp.com_The 2008 Institute Meeting_ General Session Highlights_0495A4C2.eml","Sender is probably forged (SPF Softfail)"


Here's the header for the e-mail in question:
quote:

Received: from merak.synnethosting.com ([65.182.190.25]) by INS03.mycorp.com with
Microsoft SMTPSVC(6.0.3790.3959); Wed, 3 Sep 2008 11:58:42 -0400
Received: from LISTSERV ([65.182.190.45]) by merak.synnethosting.com (SynNet Hosting
SMTP v2.0) with SMTP id JYJ25040 for <jdoe@mycorp.com>; Wed, 03 Sep 2008 10:58:40 -0500
Subject: =?UTF-8?B?VGhlIDIwMDggUE1SRyBJbnN0aXR1dGUgTWVldGluZzogR2VuZXJhbCBTZXNzaW9uIEhpZ2hsaWdodHM=?=
To: jdoe@mycorp.com
Message-ID: <74bb142f3499fcb0cbe06d824d730901@sendstudio.synnethosting.com>
Return-Path: sendstudio_bounces@synergynews.info
Date: Wed, 03 Sep 2008 11:05:34 -0500
From: "=?UTF-8?B?UE1SRw==?=" <info@pmrg.org>
Reply-To: info@pmrg.org


Notwithstanding the SPF issues, which I'll deal with separately, why does MailEssentials see this message as being "from" sendstudio_bounces@synergynews.info and not info@pmrg.org? Is there something wrong with this e-mail header? Or does MailEssentials always use the return_path to identify a message's sender?

Thanks for your help solving this problem.

- Joe
Philadelphia PA
Post #: 1
RE: SPF picking up return path instead of from address - 3.Sep.2008 3:27:31 PM   
trythiscow

 

Posts: 20
Status: offline 		I find the email header can be misleading.  SPF only performs a check against the SMTP from address.  You would have to evaluate the SMTP session logs to determine what the server declared the "Mail From" to be.  In this case it would have been: "Return-Path: sendstudio_bounces@synergynews.info"

This link explains it way better than I can.
http://www.openspf.org/FAQ/Envelope_from_scope


(in reply to joestern)
Post #: 2
Page:   [1]
All Forums >> [Content Security] >> GFI MailEssentials for Exchange/SMTP >> SPF picking up return path instead of from address Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


   © 2008. All rights reserved. GFI Software Home Products Download Trials Support Ordering Site Map About Us Contact us
GFI solutions: Exchange anti spam filter - exchange anti virus - isa server - network vulnerability scanner - event log management - USB security software - exchange archiving - fax server software