SPF Record - SPAM Still Getting Through???

[blyxx86]

I am having an issue with spam e-mail getting through my SPF records. I'm not sure why or how. The senders are spoofing the "From" section of the e-mail to be @mydomain.com.

It does seem to help and it stops SOME of them, but they still manage to get through. I turned on Intelligent Message Filtering and am monitoring the mail it is filtering. Some of the spoofed e-mail gets blocked, but not all of it.

I thought the idea of a DNS / SPF record was to have it verify the sender BEFORE it forwards it through to my mail server.

Below is the TXT/SPF record stored for all of my sub-domains.

v=spf1 ip4:1.2.3.4 mx:mail.mydomain.com ip4:10.20.30.40/29 -all
 

I also have an MX record in my internal DNS server (which is also the exchange server) that has a forward lookup to mail.mydomain.com and a TXT record that is the same as the SPF record at the DNS above.

Can someone help me with this? I've read up on it and I think I'm missing some pieces, but I don't know where.

According to many of the SPF tools, the supplied version should work. And the testing tools say that mail not from the IP/MX listed in the SPF will return a FAIL result, but that's not what I'm seeing.

Thanks!!

[blyxx86]

I may have found a solution to this!!

I will wait a few days to see if any more mail gets through.

In Windows Server 2003...

Server Management Console >>
Advanced Management >>
Domain (Exchange) >>
Global Settings >>
Right Click Message Delivery >>
Sender ID Filtering

Default was set to "Accept" when fails.
I set to Reject. Hopefully this will not cause any normal e-mails to be rejected.