I have a problem with a sender that are using a iphmx.com server adress - namely a problem with their DNS/SPF configuration.
When I asked, apparently its a cloud variant of Ironport, and I should "contact Cisco about it".
However, im not the customer who has the IronPort. Im on the receiving end.
Here is the deal:
Ironport customers are apparently advised to set a SPF record of like:
exists:%{i}.spf.hc2347-75.eu.iphmx.com
Now to the problem.
The server trying to send email to me, is 23.90.102.86 - which then, inserted into this record:
23.90.102.86.spf.hc2347-75.eu.iphmx.com --> resolves to --> 127.0.0.2
Now to the problem. This trips "DNS Rebinding protection" in the firewall and the response DNS packet is dropped. Of course, private IP adresses should not be present in such a record. This of course causes a SPF fail with corresponding reject.
What the admins of iphmx.com needs to do, is to instead set the A record to point to itself:
23.90.102.86.spf.hc2347-75.eu.iphmx.com IN A 23.90.102.86
In this way, you don't "pollute" innocent IP-adresses, it doesn't trip rebinding protection, and it wont cause any concern as only the existence of the A record is important in this case.
Any ideas on how to get in touch with the iphmx.com admins?
