0

I am currently getting a ton of email from "myself" and have been having a ton of difficulty filtering it. I have postfix configured to check SPF and (presumably) reject if it fails, and SpamAssassin has the SPF filter installed. But nothing is working. I can connect to postfix over telnet and plaintext a message from "myself" to myself without authentication and it just arrives in my inbox like it's supposed to be there.

$ sudo -u spamd -H spamassassin -D --lint 2>&1 | grep SPF
May 24 10:12:04.282 [15707] dbg: diag: [...] module installed: Mail::SPF, version v2.008
May 24 10:12:04.289 [15707] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC

relevant bits of master.cf

...
smtp      inet  n       -       n       -       -       smtpd -o content_filter=spamassassin
submission inet n       -       n       -       -       smtpd -o content_filter=spamassassin
smtps     inet  n       -       n       -       -       smtpd -o content_filter=spamassassin
policyd-spf unix - n n - - spawn user=nobody argv=/bin/python /usr/libexec/postfix/policyd-spf
spamassassin unix - n n - - pipe flags=R user=spamd argv=/usr/bin/spamc -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}
...

Excerpt main.cf

smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    check_policy_service unix:private/policyd-spf,
    reject_unauth_destination,
    reject_rhsbl_reverse_client dbl.spamhaus.org,
    reject_rhsbl_helo dbl.spamhaus.org,
    reject_rhsbl_sender dbl.spamhaus.org,
    reject_rbl_client zen.spamhaus.org

and I have the SPF defined in the txt records in my DNS (I relay all mail through mailjet due to network restrictions):

example.com. 20020 IN TXT "v=spf1 include:spf.mailjet.com ?all"

Edit: Per suggestion, I have updated my DNS, though the exact behavior still exists:

example.com. 86400 IN TXT "v=spf1 include:spf.mailjet.com -all"

Edit 2: I added a DMARC record to enforce quarantine on 100% of violations, and it's still not working:

_DMARC.example.com. 86400 IN TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com; ruf=mailto:dmarc-failures@example.com; fo=1; pct=100"

and I've checked SPF and DMARC with mxtoolbox, and everything looks good.

but Postfix just passes the mail right on through, and SA tacks on SPF_NEUTRAL in the header. So......... how do I make this work? How can I prevent this garbage email from coming through?

Edit: I don't care if SA or Postfix blocks it, I just don't want it in my inbox. I think I may have mixed up trying to integrate both blocking and that's why it's not working? Or did I misconfigure my DNS?

Edit 3: According to Method 2 here: https://serverfault.com/questions/905591/receiving-spam-from-my-own-email-address-postfix this should be working? (This question is older and uses the perl module, whereas I'm using the newer python module, but I implemented it the same way.)

  • It should be -all, and SPF by itself might not be enough. – Rui F Ribeiro May 24 '19 at 14:35
  • Thanks @RuiFRibeiro, I've updated my DNS to have -all but I still get the SPF_NEUTRAL header – Chris May 24 '19 at 14:39
  • SPF by itself in the DNS is a "recommendation". You have to do the setup on your side for filtering too. I would have a look to DMARC also. – Rui F Ribeiro May 24 '19 at 15:06
  • @RuiFRibeiro Thanks again! I have postfix running against the SPF check utility, and I have SpamAssassin running the SPF check. I've also set up DMARC to quarantine 100% of violations... still not working. absolutely no change in behavior. I'm not sure what else there is to set up? – Chris May 24 '19 at 15:23
  • How is the DMARC setup on the email server side? It is not enough to set it up on the DNS side. – Rui F Ribeiro May 24 '19 at 15:30
1

I also find that spamassassin SPF implementation is "bizarre".... instead of postfix-policyd-spf-perl and postfix-policyd-spf-python that works perfectly.

For this reason I have

  1. configured postfix to first check SPF using postfix-policyd-spf-python, blocking everything that violates SPF rules

  2. then check mail content using spamassassin + its SPF rules

Installation:

apt install postfix-policyd-spf-python

then edit file /etc/postfix/main.cf inserting the spf filtering before spamassassin (amavis in my case):

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated,  reject_unauth_destination, check_policy_service unix:private/policy-spf, check_policy_service inet:127.0.0.1:10023

and add the following line in /etc/postfix/master.cf

policy-spf  unix  -       n       n       -       -       spawn user=nobody argv=/usr/bin/policyd-spf

then restart postfix and everything will work as expected!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.