On Mon, Aug 16, 2021 at 05:25:57AM -0400, Kevin A. McGrail via mailop wrote: > > Microsoft, at a minimum, has 4 domains under their freemail umbrella: > hotmail.com, msn.com, live.com and outlook.com.
In addition, you will see a number of outlook.$countrytld such as outlook.jp, outlook.it, and I think the same applies for hotmail. So basically a metric assload of domains to look out for. Keep in mind that your users will likely have contacts who use one of those freemail domains for inertia reasons. > Checking a few days on one server and I see inbound freemail emails from IPs > in in 104.47.108 & 104.47.109 rarely and the bulk in in 40.92.x.x. > > Checking the logs for inbound on the same server for the same date range > that isn't from the 4 freemail that advertises > *.outbound.protection.outlook.com, shows at least some in 104.47. and 40.92/ > > And per > https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide, > 40.92 is listed for *.mail.protection.outlook.com, so at least according to > their documentation there is overlap and my logs appear to confirm it. They > are big ranges though so they might have it carved out but likely you have > to ask Microsoft. No method is guaranteed to be flawless, but the best suggestion I have is to take Microsoft's SPF info and go from there. Keep in mind that the info they publish may vary by region. If you're lucky enough to have a system with OpenSMTPd within reach, 'smtpctl spf walk' for a domain will be useful to retrieve that info (see https://bsdly.blogspot.com/2018/11/goodness-enumerated-by-robots-or.html for related musings). All the best, Peter -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ "Remember to set the evil bit on all malicious network traffic" delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds. _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
