Why so much Hotmail spam lately (was Re: [Mimedefang] Adding support for learning our addresses)

[Joseph Brennan]

--On Tuesday, January 31, 2006 10:54 -0500 WBrown at e1b.org wrote:

> But wouldn't it be in Microsoft's best interest to prevent their servers
> from being used to spam?


Tangent inspired by the above question:

Consider this host, which sends mail from Microsoft employees:

> Received: from smtphost1.microsoft.com ([131.107.3.116])
>        by mx.gmail.com with ESMTP id 8si3854684wrl.2006.01.27.18.04.33;
>        Fri, 27 Jan 2006 18:04:33 -0800 (PST)


No reverse DNS.
HELO smtphost1.microsoft.com, but that's the name of 131.107.1.101.
So, it looks like scam mail supposedly from Microsoft.

But 131.107.3.116 is in their _spf-a.microsoft.com SPF record.  Oh, I
get it.  We use SPF or our filter misfires.  Pretty risky stance for
them to take with their own employees' mail.


Joseph Brennan
Columbia University Information Technology