尽pipeSPF失败,但由mx.google.com提供的垃圾邮件仍然存在

一些垃圾邮件发送者使用我们的电子邮件地址作为伪造电子邮件的发件人。 现在我们已经收到了数千封来自现有电子邮件的反弹消息。

我们build立了SPF和DKIMlogging,但并没有停止。

procrastination.com TXT v=DMARC1;p=reject;sp=reject;pct=100;aspf=r;fo=0;ri=86400;rua=mailto:[email protected] IN 3600 procrastination.com TXT v=spf1 ip4:77.240.191.234 ip4:83.167.254.20 ip4:83.167.254.21 ip4:83.167.254.22 ip4:81.95.97.117 ip4:81.95.97.100 a -all 

表单邮件标题看起来像垃圾邮件发送者在他的电子邮件中使用Google SMTP mx.google.com,但是这些邮件都是SPF结果。

示例头文件如下:

  Delivery to the following recipient failed permanently: [email protected] Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the server for the recipient domain webmail.flcgil.it by webmail.flcgil.it. [109.168.127.232]. The error that the other server returned was: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table ----- Original message ----- X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-original-authentication-results:x-gm-message-state:message-id :reply-to:from:subject:date:mime-version:content-type :content-transfer-encoding:delivered-to; bh=DWSqotpOUM1r96KR6EV4WUBt9g/4xHl2j4TzsRWmYtM=; b=Z/uEm+/nMjD5ynw2bKuAtnqTFvpJ6QbUnJbXtPyYU1xONdOI+630z8WGZPfCkEjrR8 +iIrp9EH7y+3xOpEL2N5JoKtkMpcbgUuyC8N6dH5Mx1aZZXAylg1mXc6uMne2NhQAZVW XGVmikat0wxCsgSYt+T8nHXULU/OY5LlAbGiKD0EQ96nvRB0fyquVyHFvQfKLi7gORlD 939MMe1QiEw/4aH4oEigEOgMoAZe+1SxoiyJfj/M80iHtsh97bhHCukB4Yni9aX9LJEc edS2ZS9c5IBnTmTmLbQwlZXx65u9Z3FIUSU82GQSWOF6Upp2ZzHwt7Az3hbfn+Or5Sy/ lGvg== X-Original-Authentication-Results: mx.google.com; spf=fail (google.com: domain of [email protected] does not designate 66.84.38.179 as permitted sender) [email protected] X-Received: by 10.42.50.81 with SMTP id z17mr14637142icf.57.1430488267890; Fri, 01 May 2015 06:51:07 -0700 (PDT) X-Gm-Message-State: ALoCoQkCSb7aXwRPbIiUnV3a6JAZsPok55aOGUIsgkMbXM4B9QOW7RY14KvVmumEXab7Rh5k2YlELm1N9oWNNCvASrmS2cavQKBK4Kp7sNFkm6YKqjisbzTMuq6cso3vvh4X/KsH8bgCx7+Yg5E7IVbLsSgjr+rRlicTI1tXLVq88gyQdAE/3bE= X-Received: by 10.42.50.81 with SMTP id z17mr14637132icf.57.1430488267815; Fri, 01 May 2015 06:51:07 -0700 (PDT) Return-Path: <[email protected]> Received: from procrastination.net (s179.n38.n84.n66.static.myhostcenter.com. [66.84.38.179]) by mx.google.com with ESMTPS id z2si3656962icq.16.2015.05.01.06.51.07 for <[email protected]> (version=TLSv1 cipher=RC4-SHA bits=128/128); Fri, 01 May 2015 06:51:07 -0700 (PDT) Received-SPF: fail (google.com: domain of [email protected] does not designate 66.84.38.179 as permitted sender) client-ip=66.84.38.179; Authentication-Results: mx.google.com; spf=fail (google.com: domain of [email protected] does not designate 66.84.38.179 as permitted sender) [email protected] Received: from User ([154.118.4.5]) (authenticated bits=0) by procrastination.net (8.13.1/8.13.1) with ESMTP id t41DosSm007397; Fri, 1 May 2015 09:50:59 -0400 Message-Id: <[email protected]> X-Orig: [154.118.4.5] X-Authentication-Warning: procrastination.net: procrast owned process doing -bs Reply-To: <[email protected]> From: "INTERNATIONAL MONETARY FUND"<[email protected]> Subject: Attn: Your Long Over due payment claim/change of account? Date: Fri, 1 May 2015 14:51:05 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Antivirus: avast! (VPS 150501-0, 05/01/2015), Outbound message X-Antivirus-Status: Clean Delivered-To: [email protected] 

任何想法我们如何凸轮做这个停止? 为什么SPF没有帮助?

您不能强迫他人过滤基于SPF和DKIM的传入邮件,或者其他任何标准。 如果谷歌select忽略SPF,就这样吧; 你已经做好了一切,现在你所能做的就是坐下来,不要理会没有过滤SPF的人的抱怨。

也就是说,拥有一个有效的SPFlogging往往会减less反向散射,因为理性的垃圾邮件发送者会喜欢伪造一个没有有效的SPFlogging的域名的电子邮件,这个logging以-all结尾。 你可能会发现,在目前这种反向散射波已经过去之后,情况确实有所改善。

您的DMARClogging应在_dmarc.procrastination.com下。 这是一个新的规范,并没有得到广泛的支持。 如果您需要报告,则还需要包含v=DMARC1位于*._report._dmarc.procrastination.comprocrastination.com._report_dmarc.procrastination.com的TXTlogging。 当您开始获取报告时,您会知道这是行得通的。 谷歌和雅虎都可能向您发送报告。

SPF倾向于有效地减less使用您的域的欺骗电子邮件(垃圾邮件)的数量。 但是,许多网站不使用SPF阻止电子邮件,因为许多网站的loggingconfiguration不正确。 我发现我需要将某些域列入白名单,以确保我不会退回合法邮件。

您可能希望BATV发电子邮件上实施BATV (退回地址标记validation),以便拒绝反向散射垃圾邮件通知。 但是,在设置BATV之前,您应该允许一到两周,然后再阻止传入的反弹消息。

实施DKIM (域密钥识别邮件)并将其添加到您的DMARC策略中可能有助于减less欺骗邮件的传送。

有一些新闻网站,允许通过电子邮件发送给朋友错误地使用该人的电子邮件地址作为信封和地址。 这些可能会被SPF的严格解释所阻挡。