Uptick in spam

Tue Oct 27 12:40:24 UTC 2015

Am 27.10.2015 13:09, schrieb Ian Smith:
> On Mon, Oct 26, 2015 at 9:40 PM, Octavio Alvarez <octalnanog at alvarezp.org>
>  wrote:
> 
>> On 26/10/15 11:38, Jürgen Jaritsch wrote:
>> <snip>
>>
> But it is originating all from different IP addresses. Who knows if this
>> is an attack to get *@jdlabs.fr blocked from NANOG and is just getting
>> its goal accomplished.
> 
> 
> 
> This is the part that's been bugging me.  Doesn't the NANOG server
> implement SPF checking on inbound list mail?  jdlabs.fr doesn't appear to
> have an SPF record published.  It seems to me that these messages should
> have been dropped during the connection.

If it does (which I don't know), it will probably check the SPF record
of the delivering mailserver, which was not *.jdlabs.fr as far as I can
see from the mailheaders.

Jutta Zalud