With authentication quickly gaining acceptance among both e-mail receivers, like ISPs, and senders, like marketers and publishers, now’s a good time to examine how changes at Hotmail might affect your use of Sender ID and SPF records.

Authentication is the process by which you identify yourself to an e-mail receiver, such as an ISP, and verify which IP addresses are allowed to send e-mail from your domains. You can do this multiple ways, but I’ll focus here on how to make it easier for an ISP to look up your authentication record and to improve your chances of being properly identified as a legitimate sender. In fact, last week, Yahoo and eBay announced a partnership to use e-mail authentication measures to block phishing (define) attempts.

You may think: “Why do I need to know this geek stuff? That’s my IT department’s issue, not mine.” It’s like comprehending what goes on under your car’s hood. You can drive without knowing the sparkplug-firing pattern or the piston-compression rate, but when something goes wrong, you can help your mechanic find the problem faster if you have a clue about where to look first.

Same thing goes for e-mail authentication. If an increasing number of messages are blocked by an ISP, check your authentication records before tearing down your entire program.

Today, I’ll outline how Hotmail implements Sender ID and SPF, because this e-mail service has made a high-profile effort to help senders understand what it looks for and what it checks when authenticating a sender. Knowing this information might help you deliver more e-mail messages to Hotmail addresses, which is important for consumer marketers.

Sender ID vs. SPF: What’s the Difference?

These two methods, called protocols, are almost identical in syntax. They differ in how the receiver domain looks up your authentication record, which is a line of code inserted in your DNS (define) record that appears in your e-mail message headers.

SPF checks are performed against the domain from the envelope’s return-path address, typically called the bounce address. Sender ID checks are performed against the purported responsible address (PRA), that is, the visible sender address in the message.

Let’s say the domains in those addresses are the same. Then you as the sender can pass a Sender ID check with only an SPF record. If the domains are different, you should create both records and place them in the corresponding domains.

When in doubt, place your SPF record in all domains you have control over. This increases the chance the record will be placed where the receiver is checking. That’s what I mean by making it easy for your receiver.

Here’s a shorthand way to see the difference:

Sender ID’s and SPF’s syntax differs only slightly. SPF records begin with “v=spf1,” while typical Sender ID records begin “SPF2.0/PRA.” The rest of the records are identical. The basic, most ISP-friendly SPF entry is “v=spf1 a mx IP4:XXX.XXX.XX.XX –all.” For Sender ID, it would be “spf2.0/pra a mx IP4:XXX.XXX.XX.XX -all.”

Hotmail: Getting Authenticated

Hotmail has been the most vocal Sender ID advocate. Recently, it issued guidelines for creating a record and the mechanisms to avoid. Hotmail has specifically requested senders not to use the PTR (define) mechanism. It also recently asked senders to use a hard fail ” -all” at the end of their records to indicate their e-mail infrastructure is secure.

The syntax your record should use to indicate your level of e-mail security:

One last note on implementing Sender ID and SPF: It’s not uncommon for a sender to change IP addresses or providers. Most ISPs will perform authentication checks on inbound e-mail by directly querying your DNS zone.

Hotmail asks senders to notify it when they make changes, allowing it to cache the records. This makes authenticating senders and applying reputation scoring easier for Hotmail.

If you’ve changed your Sender ID and SPF records recently, use the following URL to update Hotmail: http://support.msn.com/default.aspx?productKey=senderid&mkt=en-us.

In some cases, if the Sender ID/SPF record contains syntax errors, Hotmail will even send an e-mail to alert you of the problem so you can make corrections before you have delivery problems.

Test Your Record Setup First

You can use free tools to test your authentication record, but I often prefer to view results that come directly from the receivers by checking the posted results in the e-mail headers.

Both Gmail and Hotmail provide this detail and are easy to test for compliance. You always want to see “pass” as your result, never “fail” or “neutral.” In some e-mail services, a “neutral” result might mean your e-mail gets rerouted to the bulk folder or blocked; a “fail” result always denies entry to your e-mail.

For example, an SPF Gmail headers might look like this:

Authentication-Results: mx.google.com; spf=pass (google.com: domain of postmaster@policycircle.com designates XX.XX.XX.XXX as permitted sender)

A Sender ID Hotmail header might look like this:

X-SID-PRA: FirstName LastName

X-SID-Result: Pass

Until next time, keep on deliverin’!

iptables -A INPUT -s IP-ADDRESS -j DROP

Replace IP-ADDRESS with actual IP address. For example if you wish to block ip address 65.55.44.100 for whatever reason then type command as follows:

iptables -A INPUT -s 65.55.44.100 -j DROP

If you have IP tables firewall script, add above rule to your script.

If you just want to block access to one port from an ip 65.55.44.100 to port 25 then type command:

iptables -A INPUT -s 65.55.44.100 -p tcp --destination-port 25 -j DROP

The above rule will drop all packets coming from IP 65.55.44.100 to port mail server port 25.

[Fri Apr 03 20:31:30 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:30 +0800] “POST /blog/alton4533734/wp-signup.php HTTP/1.1″ 403 233 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:31:31 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:31 +0800] “GET /blog/calandra8457410/wp-signup.php HTTP/1.1″ 403 236 “-” “Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)”
[Fri Apr 03 20:31:31 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:31 +0800] “GET /blog/alton4533734/wp-signup.php HTTP/1.1″ 403 233 “-” “Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)”

[Fri Apr 03 20:31:32 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:32 +0800] “POST /blog/calandra8457410/wp-signup.php HTTP/1.1″ 403 236 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:31:32 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:32 +0800] “POST /blog/alton4533734/wp-signup.php HTTP/1.1″ 403 233 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:31:33 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:33 +0800] “POST /blog/quyen3136999/wp-signup.php HTTP/1.1″ 403 233 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:31:33 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:33 +0800] “GET /blog/quyen3136999/wp-signup.php HTTP/1.1″ 403 233 “-” “Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)”
[Fri Apr 03 20:31:34 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:34 +0800] “POST /blog/quyen3136999/wp-signup.php HTTP/1.1″ 403 233 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:31:44 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:44 +0800] “POST /blog/williams1444475/wp-signup.php HTTP/1.1″ 403 236 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:31:45 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:45 +0800] “GET /blog/williams1444475/wp-signup.php HTTP/1.1″ 403 236 “-” “Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)”
[Fri Apr 03 20:31:45 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:45 +0800] “POST /blog/williams1444475/wp-signup.php HTTP/1.1″ 403 236 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:31:58 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:58 +0800] “POST /blog/huey9479157/wp-signup.php HTTP/1.1″ 403 232 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:31:59 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:59 +0800] “GET /blog/huey9479157/wp-signup.php HTTP/1.1″ 403 232 “-” “Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)”
[Fri Apr 03 20:31:59 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:31:59 +0800] “POST /blog/huey9479157/wp-signup.php HTTP/1.1″ 403 232 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:32:01 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:32:01 +0800] “POST /blog/cliff4256743/wp-signup.php HTTP/1.1″ 403 233 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:32:01 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:32:01 +0800] “GET /blog/cliff4256743/wp-signup.php HTTP/1.1″ 403 233 “-” “Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)”
[Fri Apr 03 20:32:02 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:32:02 +0800] “POST /blog/cliff4256743/wp-signup.php HTTP/1.1″ 403 233 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:32:03 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:32:03 +0800] “POST /blog/karlene8971285/wp-signup.php HTTP/1.1″ 403 235 “-” “curl/7.18.2 (i386-pc-win32) libcurl/7.18.2 zlib/1.2.3″
[Fri Apr 03 20:32:03 2009] [error] [client 71.205.176.113] client denied by server configuration: /home/yeo/public_html/blog
71.205.176.113 – - [03/Apr/2009:20:32:03 +0800] “GET /blog/karlene8971285/wp-signup.php HTTP/1.1″ 403 235 “-” “Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)”