[SLL] [Fwd: Delivery Status Notification (Failure)] - joe jobs

[Jules Agee]

Paul Franz wrote:
> These bounce messages (joe jobs) are being sent from valid mail servers to a valid
> address (mine) on my mail server. The cause is that the spam that causes the response
> has a return address for me. All of these mail servers are not checking SPF records or
> verifying that the spam came from a valid mx for my domain.

It doesn't look like you have SPF set up for the domain that's getting
targeted by the joe jobber.

$ dig TXT blackdog.bellevue.wa.us

; <<>> DiG 9.3.4-P1.1 <<>> TXT blackdog.bellevue.wa.us
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21793
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;blackdog.bellevue.wa.us.       IN      TXT

;; AUTHORITY SECTION:
blackdog.bellevue.wa.us. 10598  IN      SOA     Beaker.eucleides.com.
root.eucleides.com. 2010 86400 7200 2592000 345600
--8<--

I think spammers prefer to target non-SPF domains when spoofing sender
addresses.

-Jules

-- 
Jules Agee
System Administrator
Pacific Coast Feather Co.
julesa at pcf.com      x284