2

I just received an email from feedback@ranelaghhouse.com to feedback@ranelaghhouse.com which was caught by my catch-all and emailed to me.

Below are the headers for the email which show that it was sent from 191.185.233.11 but somehow through my webmail IP 185.116.214.97

My SPF record is v=spf1 a mx ip4:185.116.214.97 -all which should work so HOW in the world was this possible??

Return-Path: <feedback@ranelaghhouse.com>
Received: from server.primahc.com (server.primahc.com [185.116.214.97])
    by mtaig-mac03.mx.aol.com (Internet Inbound) with ESMTP id 6509B700000A1
    for <pawpj@aol.com>; Mon, 30 May 2016 17:54:08 -0400 (EDT)
Received: from ([191.185.233.11]) for <feedback@ranelaghhouse.com> with MailEnable Catch-All Filter; Mon, 30 May 2016 22:54:05 +0100
Received: from bfb9e90b.virtua.com.br ([191.185.233.11]) by primahc.com with MailEnable ESMTP; Mon, 30 May 2016 22:54:04 +0100
Message-ID: <424682518448599135714035@ranelaghhouse.com>
From: <feedback@ranelaghhouse.com>
To: <feedback@ranelaghhouse.com>
  • 1
    You haven't shown us the envelope-From, only the header From:. SPF has nothing to say about the header From:, so we can pass no comment on that. You need to look in your mail logs to see what MAIL FROM address was given at delivery time. – MadHatter supports Monica May 30 '16 at 22:40
6

That means that your MTA is not set to reject mail based on SPF failure or that it only does so with the proper _dmarc record.

DMARC is intended to complete SPF records to define how to treat them.

Note that DKIM validation and signature would prove to be an even more effective security measure, although it generates a bit of overhead on all sides.

  • So I need to setup DMARC? – Shivam Paw May 30 '16 at 23:10
  • DMARC is what defines how you want MTAs deal with your SPF failures. You also need to make sure your MTA follows DMARC and SPF rules to reject the messages. – Julie Pelletier May 30 '16 at 23:11
4

SPF is not a magic bullet that will prevent this. At its core, it's just a hint for the mail server about where mails allegedly coming from this domain should originate from and a mail server can do anything in between outright ignoring it, using it as a contributing factor in a spam filter or following it to the letter. How is your mail server configured to handle SPF?

  • It is setup as Plesk sets it up. How can I check that? – Shivam Paw May 30 '16 at 23:09
2

Looking over the information you posted, your MX and A record are both 85.116.214.97, so your SPF is a little overkill. You can simplify it to just v=spf1 mx -all

I looked at your contact us page on your website, I'm guessing this is where the Feedback is sent from? Based on the headers you provided, it looks like it might be possible to send emails to other people through your contact us screen. If you post the code for that section, we can see if that's what's being abused.

I did run your IP through a blacklist scanner - They are clean, which is good news, a lot of times if a server is being abused you'll show up on a few lists.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.