☰

尽管 SPF 失败，mx.google.com 仍会发送垃圾邮件

tag-icon • tag-icon email spam spf email-bounces dkim
尽管 SPF 失败，mx.google.com 仍会发送垃圾邮件

一些垃圾邮件发送者使用我们的电子邮件地址作为伪造电子邮件的发件人。现在我们收到了数千封来自不再存在的电子邮件地址的退回邮件。

我们设置了 SPF 和 DKIM 记录，但它并没有停止。

procrastination.com TXT v=DMARC1;p=reject;sp=reject;pct=100;aspf=r;fo=0;ri=86400;rua=mailto:[email protected]    IN  3600

procrastination.com TXT v=spf1 ip4:77.240.191.234 ip4:83.167.254.20 ip4:83.167.254.21 ip4:83.167.254.22 ip4:81.95.97.117 ip4:81.95.97.100 a -all

从邮件标头来看，垃圾邮件发送者似乎使用 Google SMTP mx.google.com 来发送邮件，尽管 SPF 结果失败。

示例标题如下：

    Delivery to the following recipient failed permanently:

     [email protected]

Technical details of permanent failure: 
Google tried to deliver your message, but it was rejected by the server for the recipient domain webmail.flcgil.it by webmail.flcgil.it. [109.168.127.232].

The error that the other server returned was:
550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table


----- Original message -----

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-original-authentication-results:x-gm-message-state:message-id
         :reply-to:from:subject:date:mime-version:content-type
         :content-transfer-encoding:delivered-to;
        bh=DWSqotpOUM1r96KR6EV4WUBt9g/4xHl2j4TzsRWmYtM=;
        b=Z/uEm+/nMjD5ynw2bKuAtnqTFvpJ6QbUnJbXtPyYU1xONdOI+630z8WGZPfCkEjrR8
         +iIrp9EH7y+3xOpEL2N5JoKtkMpcbgUuyC8N6dH5Mx1aZZXAylg1mXc6uMne2NhQAZVW
         XGVmikat0wxCsgSYt+T8nHXULU/OY5LlAbGiKD0EQ96nvRB0fyquVyHFvQfKLi7gORlD
         939MMe1QiEw/4aH4oEigEOgMoAZe+1SxoiyJfj/M80iHtsh97bhHCukB4Yni9aX9LJEc
         edS2ZS9c5IBnTmTmLbQwlZXx65u9Z3FIUSU82GQSWOF6Upp2ZzHwt7Az3hbfn+Or5Sy/
         lGvg==
X-Original-Authentication-Results: mx.google.com;       spf=fail (google.com: domain of [email protected] does not designate 66.84.38.179 as permitted sender) [email protected]
X-Received: by 10.42.50.81 with SMTP id z17mr14637142icf.57.1430488267890;
        Fri, 01 May 2015 06:51:07 -0700 (PDT)
X-Gm-Message-State: ALoCoQkCSb7aXwRPbIiUnV3a6JAZsPok55aOGUIsgkMbXM4B9QOW7RY14KvVmumEXab7Rh5k2YlELm1N9oWNNCvASrmS2cavQKBK4Kp7sNFkm6YKqjisbzTMuq6cso3vvh4X/KsH8bgCx7+Yg5E7IVbLsSgjr+rRlicTI1tXLVq88gyQdAE/3bE=
X-Received: by 10.42.50.81 with SMTP id z17mr14637132icf.57.1430488267815;
        Fri, 01 May 2015 06:51:07 -0700 (PDT)
Return-Path: <[email protected]>
Received: from procrastination.net (s179.n38.n84.n66.static.myhostcenter.com. [66.84.38.179])
        by mx.google.com with ESMTPS id z2si3656962icq.16.2015.05.01.06.51.07
        for <[email protected]>
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Fri, 01 May 2015 06:51:07 -0700 (PDT)
Received-SPF: fail (google.com: domain of [email protected] does not designate 66.84.38.179 as permitted sender) client-ip=66.84.38.179;
Authentication-Results: mx.google.com;
       spf=fail (google.com: domain of [email protected] does not designate 66.84.38.179 as permitted sender) [email protected]
Received: from User ([154.118.4.5])
    (authenticated bits=0)
    by procrastination.net (8.13.1/8.13.1) with ESMTP id t41DosSm007397;
    Fri, 1 May 2015 09:50:59 -0400
Message-Id: <[email protected]>
X-Orig: [154.118.4.5]
X-Authentication-Warning: procrastination.net: procrast owned process doing -bs
Reply-To: <[email protected]>
From: "INTERNATIONAL MONETARY FUND"<[email protected]>
Subject: Attn: Your Long Over due payment claim/change of account?
Date: Fri, 1 May 2015 14:51:05 +0100
MIME-Version: 1.0
Content-Type: text/plain;
    charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-Antivirus: avast! (VPS 150501-0, 05/01/2015), Outbound message
X-Antivirus-Status: Clean
Delivered-To: [email protected]

有没有什么办法可以阻止这种情况发生？为什么 SPF 没有帮助？

答案1

您无法强迫其他人根据 SPF 和 DKIM 或任何其他标准过滤其收到的邮件。如果 Google 选择忽略 SPF，那就这样吧；您已经尽了自己的一份力，现在您所能做的就是静观其变，忽略那些不使用 SPF 进行过滤的人的抱怨。

尽管如此，拥有有效的 SPF 记录确实会减少反向散射，因为理性的垃圾邮件发送者会倾向于伪造来自没有以 结尾的有效 SPF 记录的域的电子邮件-all，就像您的域一样。您可能会发现，在当前的反向散射浪潮过去之后，情况确实有所改善。

答案2

您的DMARC记录应在 之下。这是一项新规范，并未得到广泛支持。如果您需要报告，您还需要包含或的_dmarc.procrastination.comTXT 记录。当您开始收到报告时，您就会知道这是有效的。Google 和 Yahoo 都可能会向您发送报告。 v=DMARC1*._report._dmarc.procrastination.comprocrastination.com._report_dmarc.procrastination.com

SPF 确实可以有效减少使用您域名的欺骗性电子邮件（垃圾邮件）的数量。但是，许多网站不使用 SPF 来阻止电子邮件，因为许多网站的记录配置不正确。我发现我需要将某些域名列入白名单，以确保我不会退回合法邮件。

您可能希望BATV在外发电子邮件上实施（退回地址标签验证），以便拒绝反向散射垃圾邮件通知。但是，设置后，您应该等待一两周的时间BATV才能阻止传入的退回邮件。

实施DKIM（域密钥识别邮件）并将其添加到您的DMARC策略中可能有助于减少欺骗消息的传递。

有些新闻网站允许向好友发送电子邮件通知，但错误地使用该人的电子邮件地址作为信封和发件人地址。这些可能会因 的严格解释而被阻止SPF。

相关内容