Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - SPF and hotmail.com
  FAQ FAQ  Forum Search   Register Register  Login Login

SPF and hotmail.com
 Post Reply Post Reply
Author
  Topic Search Topic Search  Topic Options Topic Options
Allan View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Allan Quote  Post ReplyReply Direct Link To This Post Topic: SPF and hotmail.com
    Posted: 05 November 2004 at 6:59am

I am experiencing lot's of SPF blockings on the hotmail.com domain - is it M$ who dont know how to configure a the SPF record or just me ?

Greetings, Allan
Back to Top
Wes View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wes Quote  Post ReplyReply Direct Link To This Post Posted: 05 November 2004 at 7:50am

YES!!  Same thing here!!

I am seeing Hotmail addresses being blocked due to SPF.  It started to the best of my knowledge in the last week or so.

 
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 05 November 2004 at 10:07am

Hmmm ... in the last 8 hours I have 326 SPF blocks wit a hotmail address but I do not see a single one that should not have been blocked.  The have strange records that may not be able to be interpreted by SpamFilter versions before 388.  What version are you running?

Dan S.
Back to Top
Wes View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wes Quote  Post ReplyReply Direct Link To This Post Posted: 05 November 2004 at 10:49am

I'm running 385...

Below is example from log:

11/05/04 08:55:58:440 -- (2312) Connection from: 65.54.171.5 - Originating country : United States

11/05/04 08:55:58:644 -- (2312) Resolving 65.54.171.5 - bay4-f5.bay4.hotmail.com

11/05/04 08:55:58:690 -- msn.com is a domain, searching for SPF record

11/05/04 08:55:58:690 -- (2312) - SPF record for msn.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- hotmail.com is a domain, searching for SPF record

11/05/04 08:55:58:737 -- (2312) - SPF record for hotmail.com found. analyzing: - v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all

11/05/04 08:55:58:737 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:737 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for hotmail.com done: - softfail

11/05/04 08:55:58:753 -- (2312) - SPF analysis for msn.com done: - softfail

11/05/04 08:55:58:753 -- (2312) failed SPF test (softfail) - Disconnecting 65.54.171.5

11/05/04 08:55:58:753 -- (2312) 65.54.171.5 - Mail from: tstruyk@msn.com To: bena@gocolumbiamo.com will be rejected

11/05/04 08:55:58:894 -- (2312) Disconnect
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104 		Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 05 November 2004 at 11:19am

Try 388 at ***EDITED BY LOGSAT SUPPORT - please download latest pre-release builds by logging in the registered are of the website***

See notes below:

// New to VersionNumber = '2.1.1.388';
{TODO -cFix : Fixed SPF bug introduced in build 386 - SPF queries had incorrect "none" results}
{TODO -cFix : whitelisted emails were forwarded to alternate dest SMTP server if using option new in build 387}

// New to VersionNumber = '2.1.1.387';
{TODO -cNew : Added SpamFilter.ini option to forward email tagged as SPAM to an alternate destination SMTP server}

// New to VersionNumber = '2.1.1.386';
{TODO -cNew : Modified SPF lookups to search for SPF TXT record even if hostname is not a domain}

Dan S.
Back to Top
Wes View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Wes Quote  Post ReplyReply Direct Link To This Post Posted: 05 November 2004 at 11:49am

388 Works...

Any idea when this will released as a production version?
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 05 November 2004 at 12:05pm

No ... ask support@logsat.com .   Why, are you worried about the stability?  I am running 388 in all my instalations with no problems that I have seen.

But ... you say this fixed your issue?

Dan S.
Back to Top
BigDog View Drop Down
Newbie
Newbie


Joined: 26 January 2005
Location: United States
Status: Offline
Points: 11 		Post Options Post Options   Thanks (0) Thanks(0)   Quote BigDog Quote  Post ReplyReply Direct Link To This Post Posted: 05 November 2004 at 12:27pm

Yes, hotmail mail is now being accepted....  It would appear that MS decided  just didn't publish their hotmail spf dns records properly;  It's apparently not necessarly SpamFilter's flaw as much as Hotmail's inablity to just follow the SPF rules properly.

http://archives.listbox.com/spf-discuss@v2.listbox.com/200411/0085.html

 

I am always too conservitive, I want others to find the bugs....  :) 

Back to Top
BigDog View Drop Down
Newbie
Newbie


Joined: 26 January 2005
Location: United States
Status: Offline
Points: 11 		Post Options Post Options   Thanks (0) Thanks(0)   Quote BigDog Quote  Post ReplyReply Direct Link To This Post Posted: 12 November 2004 at 10:26am

Yes stablity is an issue, for the first time ever I lost incoming email yesterday after running the prerelease version.

All hell broke loose at 2:46 PM yesterday...  here's the log...  (this is why I don't like "pre-release" 

Let the stunt men get "on the plane", I'm riding "In the plane"!!!

11/11/04 14:46:40:354 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:40:542 -- (2748) Exception occurred during DoDeleteExpiredQuarantineList: System resource exceeded

11/11/04 14:46:40:542 -- (676) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 96 97 111) Unspecified error

11/11/04 14:46:40:542 -- (676) Disconnect

11/11/04 14:46:40:542 -- (568) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 21 23 24 25 26 27 28 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 96 97 111) Unspecified error

11/11/04 14:46:40:542 -- (2868) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 21 23 24 25 26 27 28 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 96 97 111) Unspecified error

11/11/04 14:46:40:542 -- (568) Disconnect

11/11/04 14:46:43:048 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:43:988 -- (3788) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 96 97 111) System resource exceeded

11/11/04 14:46:43:988 -- (3788) Disconnect

11/11/04 14:46:45:617 -- (2868) Disconnect

11/11/04 14:46:48:436 -- (1084) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 96 97 111) Not enough storage is available to complete this operation

11/11/04 14:46:48:436 -- (1084) Disconnect

11/11/04 14:46:49:627 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:49:627 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:51:851 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:46:57:960 -- (2660) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 96 97 111) System resource exceeded

11/11/04 14:46:57:960 -- (3144) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 96 97 111) Could not convert variant of type (Null) into type (Integer)

11/11/04 14:46:57:960 -- (2660) Disconnect

11/11/04 14:46:57:960 -- (2172) Exception occurred during RECEIVEMESSAGE: ( 1 2 3 4 5 6 7 8 9 11 12 13 15 16 17 18 19 29 30 31 32 33 54 55 56 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 96 97 111) System resource exceeded

11/11/04 14:46:57:960 -- (2172) Disconnect

11/11/04 14:46:57:960 -- (3144) Disconnect

11/11/04 14:47:03:865 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:22:960 -- (196) EMail from antifraud.ref.num577528@suntrust.com to SES@ci.columbia.mo.us was received and quarantined. Size: 14 KB, 14336 bytes

11/11/04 14:47:22:960 -- (196) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:23:007 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:47:23:022 -- (196) Disconnect

11/11/04 14:47:23:618 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:31:982 -- (772) Error occurred while checking for new build

11/11/04 14:47:35:616 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:37:449 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:40:206 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:41:005 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:43:433 -- (3708) EMail from error-1-36315546-2244-663721@r.expertsavings.com to ckmccoll@gocolumbiamo.com was received and quarantined. Size: 2 KB, 2048 bytes

11/11/04 14:47:43:433 -- (3708) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:43:480 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:47:43:495 -- (3708) Disconnect

11/11/04 14:47:45:156 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:46:910 -- (3740) EMail from sorogers@OUTGOING82.myredemail.com to ajb@ci.columbia.mo.us was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:47:46:910 -- (3740) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:46:973 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:47:46:988 -- (3740) Disconnect

11/11/04 14:47:47:286 -- (1868) EMail from sorogers@OUTGOING82.myredemail.com to ajb@ci.columbia.mo.us was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:47:47:286 -- (1868) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:47:349 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:47:47:364 -- (1868) Disconnect

11/11/04 14:47:50:685 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:51:782 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:47:55:149 -- (3468) Listen Exception occurred: Access violation at address 77F60E69 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:48:59:152 -- (2916) EMail from ourcsjibm@garfield.com to hr@gocolumbiamo.com, hrc@gocolumbiamo.com was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:48:59:152 -- (2916) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:48:59:199 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:48:59:215 -- (2916) Disconnect

11/11/04 14:49:38:328 -- (3216) EMail from mcallahan_uf@moensters.de to em@gocolumbiamo.com was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:49:38:328 -- (500) EMail from dhurstxl@stanley.co.jp to jbm@ci.columbia.mo.us was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:49:38:328 -- (3216) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:49:38:328 -- (500) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:49:38:328 -- (1024) EMail from valentin_beard_pt@orion.toppoint.de to clr@gocolumbiamo.com was received and quarantined. Size: 1 KB, 1024 bytes

11/11/04 14:49:38:328 -- (1024) Error disconnecting: Access violation at address 77F683B6 in module 'ntdll.dll'. Read of address 6F794054

11/11/04 14:49:38:375 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:49:38:406 -- (500) Disconnect

11/11/04 14:49:38:406 -- (3216) Disconnect

11/11/04 14:49:38:406 -- (1024) Disconnect

11/11/04 14:49:38:422 -- (2792) Time to add Msg to Bayes corpus:0

11/11/04 14:49:38:453 -- (2792) Time to add Msg to Bayes corpus:0
Back to Top
fdickey View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote fdickey Quote  Post ReplyReply Direct Link To This Post Posted: 05 January 2005 at 5:34pm

Ok..now I'm getting softfail SPF errors with hotmail.com:

01/05/05 10:41:21:651 -- (3388) Connection from: 64.4.56.27  -  Originating country : United States
01/05/05 10:41:27:939 -- (3388) Resolving 64.4.56.27 - bay101-f17.bay101.hotmail.com
01/05/05 10:41:33:006 -- (3388) found SPF record: v=spf1 include:spf-a.hotmail.com include:spf-b.hotmail.com include:spf-c.hotmail.com include:spf-d.hotmail.com ~all
01/05/05 10:41:38:003 -- (3388) - SPF analysis for spf-a.hotmail.com done: - none
01/05/05 10:41:38:003 -- Warning: Error during SPF record check - TimedOut
01/05/05 10:41:48:016 -- (3388) - SPF analysis for spf-c.hotmail.com done: - none
01/05/05 10:41:48:016 -- Warning: Error during SPF record check - TimedOut
01/05/05 10:41:53:013 -- (3388) - SPF analysis for spf-d.hotmail.com done: - none
01/05/05 10:41:53:013 -- Warning: Error during SPF record check - TimedOut
01/05/05 10:41:53:013 -- (3388) SPF query result:
01/05/05 10:41:53:013 -- (3388) - SPF analysis for hotmail.com done: - softfail
01/05/05 10:41:53:013 -- (3388) failed SPF test (softfail) - Disconnecting 64.4.56.27

This is in version .395 and I'm not having this issue with any other domain.  Is hotmail.com just messing up there own SPF record or what?
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104 		Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 12 January 2005 at 9:57am
Fred,

Are you seing other instances of the softfail from hotmail, or is that the only example you found in the logs? If there's more, could you please post those as well?

What we believe is happening is that hotmail specified several sub-domains to include in the DNS query, and each is to be in turn queried. While some will softfail because, if the IP is legitimate eventuallyone of them will result in a "pass". SpamFilter will ignore all fails and softfails should a pass be found. However in your sample we see several timeouts, possibly occurring on the domain that does pass. If so, this may be a bug, as timeouts should not be causing a test to fail.

Roberto F. LogSat Software
Back to Top
fdickey View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote fdickey Quote  Post ReplyReply Direct Link To This Post Posted: 12 January 2005 at 11:26am

Yes, it's happening frequently with hotmail.com transmissions that look legit based upon the reverse DNS results, etc.  I will go through our logs and post them later today as well as for another domain that is doing the same thing (can't remember off the top of my head).

Also, we are going to be purchasing our registered version of spamfilter today...woohoo!  The ability to automatically process forced delivery attempts will definetly be a warm welcome and save me work that is starting to grow exponentially with manually doing forced deliveries.

Thank you guys for all your support and for allowing users to use all the features, save the automated forced delivery feature without having to make an upfront purchase.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.082 seconds.

Copyright (c)2002-2021 LogSat Software LLC - Sales: sales@LogSat.com
Contact Us