Looks like SPF-filter is not looking at subdomain. When sender is burkskinka@skutan.smf.se i want to check spf-record for skutan.smf.se NOT smf.se. I want to have a "harder" spf-setting for smf.se and a softer for most of my subdomains - at least in the begining.

SPF-setting for smf.se is:   v=spf1 ip4:193.15.18.0/24 -all
SPF-setting for skutan.smf.se is:   v=spf1 ip4:193.15.18.0/24 ~all

Program bug? ... or my missunderstanding?

I have chage the adress in the log to burkskinka@skutan.smf.se. It is one of my spamtraps - do not use it.   :)

10-21-04 13:57:57:616 -- (1380) Connection from: 212.247.198.186  -  Originating country : Sweden
10-21-04 13:57:58:076 -- (1380) Resolving 212.247.198.186 - s24.loopia.se
10-21-04 13:57:58:086 -- smf.se is a domain, searching for SPF record
10-21-04 13:57:58:086 -- (1380) - SPF record for smf.se found. analyzing: - v=spf1 ip4:193.15.18.0/24 -all
10-21-04 13:57:58:086 -- (1380) - SPF analysis for smf.se done: - fail
10-21-04 13:57:58:086 -- (1380) failed SPF test (fail) - Disconnecting 212.247.198.186
10-21-04 13:57:58:086 -- (1380) 212.247.198.186 - Mail from: burkskinka@skutan.smf.se To: burkskinka@skutan.smf.se will be rejected
10-21-04 13:57:59:058 -- (1380) EMail from burkskinka@skutan.smf.se to burkskinka@skutan.smf.se was received and quarantined. Size: 1 KB, 1024 bytes

It is a subdomain AND has an A-record. Is that not ok in DNS?

I think you have done the same with logsat.com and test.logsat.com. A-record and TXT=v=spf1....

Header:
   ID=40433, QR=Response, Opcode=QUERY, RCODE=NO ERROR
   Authoritative Answer=Yes, Truncation=No
   Recursion Desired=Yes, Recursion Available=Yes
   QDCOUNT=1, ANCOUNT=3, NSCOUNT=0, ARCOUNT=3
Question:
   Name=skutan.smf.se, QTYPE=ALL, QCLASS=1
Answer Section:
   Name=skutan.smf.se
   Type=A, Class=1, TTL=86400, RDLENGTH=4
   IP Address=193.15.18.1
   Name=skutan.smf.se
   Type=MX, Class=1, TTL=60, RDLENGTH=9
    Preference=10, Mail Exchange=mail.smf.se
   Name=skutan.smf.se
   Type=TXT, Class=1, TTL=3600, RDLENGTH=31
   TXT=v=spf1 ip4:193.15.18.0/24 ~all
---
End of output

Nippe,

When I checked your DNS yesterday skutan.smf.se did not seem to be a domain. I checked again with an nslookup and got:

> skutan.smf.se
Server:  ns1.smf.se
Address:  193.15.18.2

smf.se
        primary name server = ns1.smf.se
        responsible mail addr = administrator.smf.se
        serial  = 2004102203
        refresh = 1200 (20 mins)
        retry   = 120 (2 mins)
        expire  = 1209600 (14 days)
        default TTL = 3600 (1 hour)

> server ns1.smf.se
Default Server:  ns1.smf.se
Address:  193.15.18.2

> ls -d skutan.smf.se
[ns1.smf.se]
*** Can't list domain skutan.smf.se: Non-existent domain

To double-check, I tried the following. As you correctly stated, we have a test.logsat.com subdomain here at logsat. Here's a query for it NS records:

> set type=ns
> test.logsat.com
Server:  ns1.smf.se
Address:  193.15.18.2

Non-authoritative answer:
test.logsat.com nameserver = ns1.netwide.net
test.logsat.com nameserver = ns2.netwide.net

If I ask for an NS query on a A record that is not a domain, ex. http://www.logsat.com, I get:

> http://www.logsat.com
Server:  ns1.smf.se
Address:  193.15.18.2

logsat.com
        primary name server = naples.netwide.net
        responsible mail addr = pemiller.netwide.net
        serial  = 4102001
        refresh = 10800 (3 hours)
        retry   = 3600 (1 hour)
        expire  = 604800 (7 days)
        default TTL = 43200 (12 hours)

If I now run a NS query on skutan.smf.se I get something very similar to our http://www.logsat.com A record (not domain):

> skutan.smf.se
Server:  ns1.smf.se
Address:  193.15.18.2

smf.se
        primary name server = ns1.smf.se
        responsible mail addr = administrator.smf.se
        serial  = 2004102203
        refresh = 1200 (20 mins)
        retry   = 120 (2 mins)
        expire  = 1209600 (14 days)
        default TTL = 3600 (1 hour)

All seems to indicate a DNS config problem. But it *is* late night here as I type, and I may not be completely lucid... Without mentioning that DNS is one of the trickiest things to configure on the internet, and that I could very possibly be wrong on my assumptions.

It may help if you post your DNS zone files for the smf.se and the skutan.smf.se domains, along with the startup files, so we can try to see if there's anything wrong there.

I saw the SPF page with the results for your domain, but please note that during our development we saw that the SPF standards are not very clear, and many developers do not follow them precisely (including the original SPF developers themselves...). For example, one of our earlier versions of SpamFilter tried to find an SPF record even for an "email domain", ex roberto@http://www.logsat.com. This probably would have found the SPF record in your case. But that was wrong, since http://www.logsat.com is yes an email domain, but is not a domain as far as DNS it is concerned. We issued a patch that "fixed" that.

Roberto F.
LogSat Software

Yeap, I saw the same thing. But the issue is not the presence of the TXT record on skutan.smf.se (it's indeed present). The problem is that the SPF filter will only look at a TXT record if the entry at the right of the @ sign in the email address (skutan.smf.se in this case) is an actual "domain". If it's simply an entry in the DNS with an A or CNAME record, that's not good enough. It needs to be an actual domain for the SPF filter to work. And as you said, the domain is secured so I can't check without having more info.

Roberto F. LogSat Software

Nippe,

I've just posted the follwoing in the parallel SPF thread:

=================================== Even though it apparently is against the SPF guidelines, we are noticing several domains being "misconfigured" that are reported as having valid SPF records by various SPF implementations.

At this point we decided to "go with the flow", and relax our implementation of SPF a little, marking as valid SPF records for hostnames that are not proper domains. We made available for download in the registered user area pre-release build 2.1.1.386 that has these changes.

Roberto F. LogSat Software ===================================