Am 27.10.2015 13:09, schrieb Ian Smith:
On Mon, Oct 26, 2015 at 9:40 PM, Octavio Alvarez <octalnanog@alvarezp.org> wrote:
On 26/10/15 11:38, Jürgen Jaritsch wrote: <snip>
But it is originating all from different IP addresses. Who knows if this
is an attack to get *@jdlabs.fr blocked from NANOG and is just getting its goal accomplished.
This is the part that's been bugging me. Doesn't the NANOG server implement SPF checking on inbound list mail? jdlabs.fr doesn't appear to have an SPF record published. It seems to me that these messages should have been dropped during the connection.
If it does (which I don't know), it will probably check the SPF record of the delivering mailserver, which was not *.jdlabs.fr as far as I can see from the mailheaders. Jutta Zalud