3 ms·

Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and A

by ryan-c 8y ago

Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results. The current SPF records for telus.com don't seem to allow sending by 69.64.35.11. Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed? Also, the timestamps on the received headers differ by a lot. This one: Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <my.email.fake@gmail.com>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) appears to be identical (except for the email address) for the two sample sets of headers in the thread.

zephharben 8y ago
mxtoolbox indicates that SPF for telus.com redirects to "_spf_telus_com.nssi.telus.com", which designates "_spf.google.com" as an authorized sender. That's why the SPF check doesn't fail. However, in the year 2018 I'm shocked that Gmail would put messages that fail dmarc into users' inboxes.
- ryan-c 8y ago
  It's not being sent from any of the IPs listed under _spf.google.com, though.
ryan-c 8y ago
Telus has this entry: exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com Reading RFC 7208, that would be expanded to exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com which means if that any record exists at that name, it will pass. dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com 127.0.0.1 trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send for it.
- tetha 8y ago
  It seems like everything in the zone "spf.nssi.telus.com" resolves, regardless of further DNS labels. So yeah, I'd say every host with any IP is allowed to send mails as anything from telus.com. That's a bit unsettling.
  - ryan-c 8y ago
    They appear to have quitely fixed it.
    - tetha 8y ago
      Indeed, the DNS records are gone. They had a tweet[1] 1 hour or 2 ago how they are working on it. I guess someone got phoned on his sunday to fix it. I'm hoping for a further update from their side what happened. 1: https://twitter.com/TELUSsupport/status/988060048843657216 https://twitter.com/TELUSsupport/status/988060048843657216
- admin1239 8y ago
  asda
- admin1239 8y ago
  waaaaa

by ryan-c 8y ago

zephharben 8y ago

mxtoolbox indicates that SPF for telus.com redirects to "_spf_telus_com.nssi.telus.com", which designates "_spf.google.com" as an authorized sender. That's why the SPF check doesn't fail. However, in the year 2018 I'm shocked that Gmail would put messages that fail dmarc into users' inboxes.

ryan-c 8y ago
It's not being sent from any of the IPs listed under _spf.google.com, though.

ryan-c 8y ago

Telus has this entry: exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com Reading RFC 7208, that would be expanded to exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com which means if that any record exists at that name, it will pass. dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com 127.0.0.1 trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send for it.

tetha 8y ago
It seems like everything in the zone "spf.nssi.telus.com" resolves, regardless of further DNS labels. So yeah, I'd say every host with any IP is allowed to send mails as anything from telus.com. That's a bit unsettling.
- ryan-c 8y ago
  They appear to have quitely fixed it.
  - tetha 8y ago
    Indeed, the DNS records are gone. They had a tweet[1] 1 hour or 2 ago how they are working on it. I guess someone got phoned on his sunday to fix it. I'm hoping for a further update from their side what happened. 1: https://twitter.com/TELUSsupport/status/988060048843657216 https://twitter.com/TELUSsupport/status/988060048843657216
admin1239 8y ago
asda
admin1239 8y ago
waaaaa