Subject: Re: [Tools-team] Minutes from the 30 November Teleconference

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 01 Dec 2005 17:50:45 +0100

Hi Andrew,

I found your lost mail in my daily spam summary for yesterday.

Here's the spamassassin analysis:

Content analysis details:   (3.6 points, 2.5 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 2.0 X_HELO_CHECK_FAILED    Message has X-Helo-Check-Failed
 2.7 X_HOST_LOOKUP_FAILED   Message has X-Lookup-Failed
 0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
 1.3 INFO_TLD               URI: Contains an URL in the INFO top-level domain
-2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
                            [score: 0.0000]
 3.2 NO_DNS_FOR_FROM        DNS: Envelope sender has no MX or A DNS records
-3.1 AWL                    AWL: From: address is in the auto white-list

The three main offenders are all related to the mailserver's claimed
identity, I think.

It says it's mail.libertyrms.com, but that resolves to 207.219.45.53;
while the mailserver is sending from 207.219.45.62.  

The reverse lookup is also broken: 207.219.45.62 resolves to gateway.libertyrms.info, not to anything in libertyrms.com (or
ca.afilias.info, for that matter, but I don't think exim is checking
that).

Finally, the envelope from domain (dba3.int.ca.afilias.info) has
neither MX or A records... (neither has int.ca.afilias.info, but
ca.afilias.info does).

Regards,

	Henrik

on 2005-11-30 18:57 Andrew Sullivan said the following:
> On Wed, Nov 30, 2005 at 06:44:05PM +0100, Henrik Levkowetz wrote:
>> Hi,
>> 
>> Here are some notes from today's meeting.
> 
> Hi,
> 
> Sorry this mail didn't get through earlier -- it seems there was some
> trouble with mail relaying from inside our local network.  Anyway,
> I'm having to watch the ICANN DNSSEC meeting going on just now
> (started at noon my time), so I couldn't make this meeting.  My
> apologies.
> 
> A
> 
> 

_______________________________________________
Tools-team mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-team

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 1 Dec 2005 12:32:43 -0500

> I found your lost mail in my daily spam summary for yesterday.

Yes, I'm not surprised.  I did some poking at this myself, and
discovered an extremely embarrassing misconfiguration at one of the
local name servers.  (To be fair to the sysadmins around here, we
just moved offices, and the electricians were 2 weeks behind
schedule.  So I have a feeling that something got misconfigured
during the move, but it's sort of awful to be making mistakes on DNS
given what we do for a living.)

The reverse lookup has been sorted, so that shouldn't happen any
more.  I confess that I still do not understand the actual reason as
to why the outbound headers can't be rewritten to hide the internal
identity of this machine (which is my workstation, and unreachable
due to NAT); nor why we continue to use our old libertyrms.{com|info}
names for some services around here.  The personnel-to-jobspending
ratio probably has something to do with it.  But I'm still sort of
annoyed about it.  

Anyway, thanks for spotting this (and apologies that the outbound
headers on this one are bound still to look wrong, if no longer
outright broken).

A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
                                        +1 416 646 3304 x4110

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 01 Dec 2005 19:08:20 +0100

Hi Andrew,

on 2005-12-01 18:32 Andrew Sullivan said the following:
[...]
> schedule.

Ouch!

> So I have a feeling that something got misconfigured

Humm... yes ;-)

> more.

Right, that matches what I see here.

> I confess that I still do not understand the actual reason as

Right.  But I understand about moves and missing manpower.

> headers on this one are bound still to look wrong, if no longer

Well, the reverse lookup fix was enough that this one didn't end
up in the spam bin :-)

I'm now seeing this:

X-Spam-Status: No, score=0.8 required=2.5 tests=AWL,BAYES_00,FORGED_RCVD_HELO,
	INFO_TLD,X_HELO_CHECK_FAILED autolearn=no version=3.1.0
Delivery-date: Thu, 01 Dec 2005 18:33:25 +0100
Received: from vgateway.libertyrms.info ([207.219.45.62] helo=mail.libertyrms.com)
	by shiraz.levkowetz.com with esmtp (Exim 4.54)
	id 1EhsJ8-0006hL-7J
	for [email-masked]; Thu, 01 Dec 2005 18:33:25 +0100

Regards,

	Henrik