Hi There,
I have done a fair bit of research on how to implement SPF on Exchange 2010 but my users are still receiving SPAM email from outside our organisation with either another email address from our domain or their own email address spoofed as the FROM address.
I went through the Microsoft Wizard to generate my SPF TXT record and have added it to our public DNS entry (more than a month ago) I may have tweaked it a bit manually I can’t remember.
I retrieved this from Google’s public DNS server (8.8.8.8)
"v=spf1 a mx ptr ip4:111.67.4.130 mx:mail.vjray.com.au ip4:203.45.251.121 -all"
The IP addresses are indeed the only two servers that we send email from and nowhere else.
Below is the header from one of these messages where the receivers own email address is used as the from address.
The only thing I have changed is the username part of her email address so not to attract more SPAM for her. We will call her Kevin, in this example :)
I know I could block SCL 5 but the current company policy is to accept and deliver them.
(SCL 6,7,8 are quarantined SCL 9 is discarded)
I'd expect a spoofed From address to get a much higher SPF Raiting.
To keep things concise I guess my question is why do I see this line in the headers.
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (COMPANYSRV.campsie.local:
kevin@vjray.com.au does not designate permitted sender hosts)
Full Header Below
Received: from gmail.com (186.114.39.173) by campsie.vjray.com.au (10.0.0.3)
with Microsoft SMTP Server id 14.1.438.0; Fri, 1 Nov 2013 13:34:14 +1100
Received: from [93.169.174.6] (helo=hnjzhvkltsb.chmpmudl.tv) by with esmtpa
(Exim 4.69) (envelope-from ) id 1MMVW3-1351jv-V3 for
kevin@vjray.com.au;
Thu, 31 Oct 2013 21:45:02 -0500
Date: Thu, 31 Oct 2013 21:45:02 -0500
From: Kevin@vjray.com.au
X-Mailer: The Bat! (v3.5.30) Professional
X-Priority: 3 (Normal)
Message-ID: <1660370917.PDXZ84G6851560@wttnjsliveo.ackshcddj.va>
To: kevin@vjray.com.au
Subject: Environmental organization is expanding and currently recruiting worldwide reps
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-2"
Content-Transfer-Encoding: 7bit
Return-Path: kodachrome9@gmail.com
X-MS-Exchange-Organization-AuthSource: COMPANYSRV.campsie.local
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-PRD: vjray.com.au
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (COMPANYSRV.campsie.local:
kevin@vjray.com.au does not designate permitted sender hosts)
X-MS-Exchange-Organization-SCL: 5
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.12930.1083;SID:SenderIDStatus None;OrigIP:186.114.39.173
X-MS-Exchange-Organization-AVStamp-Mailbox: AVGESE;10019;0;
X-PP-Proceessed: ca7fae93-0d2f-4db6-86a4-335194710b06
Thanks in advance
David