Yet Another Cycling Forum
General Category => The Knowledge => Ctrl-Alt-Del => Topic started by: SoreTween on 04 April, 2021, 03:13:20 pm
-
I've just received this mail delivery failure:
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
nc-strahlca@netcologne.de
(generated from carsten.strahl@koeln.de)
host cc-mx3.netcologne.de [2001:4dd0:100:1062:25:3:0:3]
SMTP error from remote mail server after end of data:
550 Sorry your message looks like a spam and we don't want it. If you believe this is wrong, contact spfb@netcologne.de and mention id=153929::1616948557-0000784D-0F2C2CC3/10/38376054500
______________________________________________
This email has been scanned by Netintelligence
http://www.netintelligence.com/email
Reporting-MTA: dns; manhattan.snafu.de
Action: failed
Final-Recipient: rfc822;carsten.strahl@koeln.de
Status: 5.0.0
Remote-MTA: dns; cc-mx3.netcologne.de
Diagnostic-Code: smtp; 550 Sorry your message looks like a spam and we don't want it. If you believe this is wrong, contact spfb@netcologne.de and mention id=153929::1616948557-0000784D-0F2C2CC3/10/38376054500
Return-path: <v>
Received: from net-93-147-239-161.cust.vodafonedsl.it ([93.147.239.161])
by manhattan.snafu.de with esmtp (Exim 4.94)
id 1lQYBQ-00008x-As
for carsten.strahl@koeln.de; Sun, 28 Mar 2021 18:22:36 +0200
Date: 28 Mar 2021 18:55:36 +0100
From: "carsten.strahl@koeln.de" <USER@MYDOMAIN>
X-Priority: 3
Message-ID: <098207061.202103281922@MYDOMAIN>
To: <carsten.strahl@koeln.de>
Subject: Re:Bitcoin Investment
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-SA-Exim-Connect-IP: 93.147.239.161
X-SA-Exim-Mail-From: USER@MYDOMAIN
X-SA-Exim-Scanned: No (on manhattan.snafu.de); SAEximRunCond expanded to false
USER is a valid alias, I can't remember what it was set up for. Some one-time shopping thing probably, I'll be able to look it up when I'm home.
MYDOMAIN is my .co.uk domain
I'm pretty confident I don't have interlopers in or relaying through my mail server, it's been shut down for 4 weeks. More likely someone has guessed/rainbowed/bruteforced my ISP passwords. There could be a nasty in our network but remote use is more likely.
I've suspected something like this might be going on for a while, lots of domains, e.g. road.cc refuse to send emails to me as if I'm on a naughty list. Is there anything I can do other than phase out using the domain and start another?
-
For someone to generate an email pretending to come from a particular email address on your domain it does not require a breach of your security. Any one can claim to be sending from that domain.
It is important to set up DNS SPF records so that smtp servers can sport illegitimate emails pretending to come from you and just delete them.
-
This. Anyone can generate an email with whatever they like in the 'from' field. That's how email works. The only thing you can do is help the recipeints' spam filters recognise when it isn't coming from you, using DKIM, SPF and DMARC.
-
And welcome to the DKIM rabbit hole. It's worth it in the end.
-
Thanks. If I can take this one acronym at a time I might just get through without my head exploding.
No SPF records set for my domains. I'll see if I can do anything about that next Sunday.
-
That said, in this instance, the recipient's spam filter has correctly identified the message as spam and rejected it, which is why you're getting a bounce.
Tomorrow's lesson is backscatter and how to avoid it...
-
That is true - it does not prevent the spammer trying, but knowing they are likely to fail means they will look elsewhere. (At least in my experience and I have a domain that became a bit of a target).
I suppose it is like visible burglar alarms. They are a great deterrent until everyone on the street has one.
-
That is true - it does not prevent the spammer trying, but knowing they are likely to fail means they will look elsewhere. (At least in my experience and I have a domain that became a bit of a target).
I find it hard to believe that spammers who can send out emails by the million at virtually zero cost bother to take the time to check out any of the spoofed origin addresses that they use for each mailshot.
-
That is true - it does not prevent the spammer trying, but knowing they are likely to fail means they will look elsewhere. (At least in my experience and I have a domain that became a bit of a target).
I find it hard to believe that spammers who can send out emails by the million at virtually zero cost bother to take the time to check out any of the spoofed origin addresses that they use for each mailshot.
I suppose not if they are picking random domains and sending a few emails from each. If they are sending several million allegedly from one domain I suppose it is worth the extra couple of lines of code.
All I can say it solved the problem for us (and it was quite major)
-
This. Anyone can generate an email with whatever they like in the 'from' field. That's how email works.
If the postman delivered a letter claiming to be from a friend, but that obviously wasn't, I would not assume that someone had broken into my friend's house to send it.
Email was, in many respects, modelled on the postal service. There's even a Post Office Protocol. And the evidence in email that it came from where it says it came from is approximately as strong as that in the post.
-
soretween
This is a decent and concise explanation of the whole process
https://www.endpoint.com/blog/2014/04/15/spf-dkim-and-dmarc-brief-explanation
It's a little out of date now in the DMARC is more accepted now.
I'm at the stage the DMARC is now configured but still in test mode due to an annoying third party.
-
Thank you Morat, very useful.
I've set spf on one domain, once it propagates I'll run some tests and if nothing breaks do the others next weekend.