Postfix SPF check - Revision history

ZhangHuangbin at 14:32, 23 April 2013

ZhangHuangbin — Tue, 23 Apr 2013 14:32:05 GMT

← Older revision		Revision as of 14:32, 23 April 2013
Line 2:		Line 2:

	----		----
-	NOTE: This tutorial is contributed by iRedMail user, please use it on your own.	+	'''NOTE''':
		+	* This tutorial is contributed by iRedMail user, please use it on your own.
		+	* iRedMail has SPF check enabled with Amavisd-new and perl module '''perl-Mail-SPF''' after queue, so you don't need this if after-queue SPF verification is ok for you.
	----		----

ZhangHuangbin at 12:27, 13 November 2012

ZhangHuangbin — Tue, 13 Nov 2012 12:27:45 GMT

← Older revision		Revision as of 12:27, 13 November 2012
Line 1:		Line 1:
	__TOC__		__TOC__
		+
		+	----
		+	NOTE: This tutorial is contributed by iRedMail user, please use it on your own.
		+	----

	= Summary =		= Summary =

ZhangHuangbin: /* Final notes */

ZhangHuangbin — Wed, 11 May 2011 06:25:28 GMT

Final notes

← Older revision		Revision as of 06:25, 11 May 2011
Line 62:		Line 62:

	--[[User:Maxie ro\|Maxie ro]] 20:13, 15 February 2011 (UTC)		--[[User:Maxie ro\|Maxie ro]] 20:13, 15 February 2011 (UTC)
		+
		+	[[Category: iRedMail/FAQ]]
		+	[[Category: FAQ]]

Maxie ro: /* Configuration */

Maxie ro — Tue, 15 Feb 2011 20:14:43 GMT

Configuration

← Older revision		Revision as of 20:14, 15 February 2011
Line 22:		Line 22:
	defaultSeedOnly = 0		defaultSeedOnly = 0
	</pre>}} so no messages are actually rejected by policyd-SPF. You will thus be able to check the effect of your config without losing important messages.		</pre>}} so no messages are actually rejected by policyd-SPF. You will thus be able to check the effect of your config without losing important messages.
-
-	~~--[[User:Maxie ro\|Maxie ro]] 20:12, 15 February 2011 (UTC)~~

	For example, a quite good configuration for fighting spam (but not losing legitimate messages) would contain		For example, a quite good configuration for fighting spam (but not losing legitimate messages) would contain

Maxie ro at 20:13, 15 February 2011

Maxie ro — Tue, 15 Feb 2011 20:13:19 GMT

← Older revision		Revision as of 20:13, 15 February 2011
Line 62:		Line 62:
	defaultSeedOnly = 1		defaultSeedOnly = 1
	</pre>}}		</pre>}}
		+
		+	--[[User:Maxie ro\|Maxie ro]] 20:13, 15 February 2011 (UTC)

Maxie ro at 20:12, 15 February 2011

Maxie ro — Tue, 15 Feb 2011 20:12:57 GMT

← Older revision		Revision as of 20:12, 15 February 2011
Line 22:		Line 22:
	defaultSeedOnly = 0		defaultSeedOnly = 0
	</pre>}} so no messages are actually rejected by policyd-SPF. You will thus be able to check the effect of your config without losing important messages.		</pre>}} so no messages are actually rejected by policyd-SPF. You will thus be able to check the effect of your config without losing important messages.
		+
		+	--[[User:Maxie ro\|Maxie ro]] 20:12, 15 February 2011 (UTC)

	For example, a quite good configuration for fighting spam (but not losing legitimate messages) would contain		For example, a quite good configuration for fighting spam (but not losing legitimate messages) would contain

Maxie ro: Created page with 'TOC = Summary = Using the Python version of SPF Policy Server for Postfix it is possible to implement checking of SPF of incoming messages in Postfix, with immediate reject…'

Maxie ro — Tue, 15 Feb 2011 20:10:42 GMT

Created page with '__TOC__ = Summary = Using the Python version of SPF Policy Server for Postfix it is possible to implement checking of SPF of incoming messages in Postfix, with immediate reject…'

New page

__TOC__

= Summary =

Using the Python version of SPF Policy Server for Postfix it is possible to implement checking of SPF of incoming messages in Postfix, with immediate reject or pass (if desired).
This article will describe how to achieve this feature.

== Notes ==
* There is also a Perl version of the software, but it is not recommended because it does not scale well and should only be used for small scale servers.
* This tutorial was written for a CentOS-based system. Please adapt it to fit your distro and configuration.
* It is assumed that the user has good knowledge of the technologies used therein.

= Installation =
* Download the latest version of pypolicyd-spf from [https://launchpad.net/pypolicyd-spf/ the project's home page].
* Unpack it and install it by using the instructions in the ''README'' file.

= Configuration =
Set-up your '''''/etc/python-policyd-spf/policyd-spf.conf''''' to fit your needs.

At the beginning, make sure you set:
{{cfg|/etc/python-policyd-spf/policyd-spf.conf|<pre>
defaultSeedOnly = 0
</pre>}} so no messages are actually rejected by policyd-SPF. You will thus be able to check the effect of your config without losing important messages.

For example, a quite good configuration for fighting spam (but not losing legitimate messages) would contain
{{cfg|/etc/python-policyd-spf/policyd-spf.conf|<pre>
HELO_reject = Fail
Mail_From_reject = Fail
PermError_reject = False
TempError_Defer = False
skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0//104,::1//128
</pre>}}
The meaning of each parameter is explained in the ''README'' file and in the man page ('''''man 5 policyd-spf.conf''''').

= Enable SPF check in Postfix =
Edit your '''''master.cf''''' file and add at the end:
{{cfg|/etc/postfix/master.cf|<pre>
# SPF check
spfpolicy unix - n n - - spawn
user=nobody argv=/usr/bin/python /usr/bin/policyd-spf
</pre>}}

Edit your '''''main.cf''''' file and add the following line in ''smtpd_recipient_restrictions'', towards the end, but before the main policyd service (usually running on port 10031):
{{cfg|/etc/postfix/main.cf|<pre>
smtpd_recipient_restrictions =
...
check_policy_service unix:private/spfpolicy,
...
</pre>}}

Restart postfix:
{{cmd|<pre>
/etc/init.d/postfix restart
</pre>}}

== Final notes ==
* Verify the effect of your changes by checking the maillog.
* When you are happy with a set of config parameters for pypolicyd-spf, be sure to enable actual SPF enforcing:
{{cfg|/etc/python-policyd-spf/policyd-spf.conf|<pre>
defaultSeedOnly = 1
</pre>}}