I'm running postfix on a Linode.
Linux redacted 5.3.11-x86_64-linode131 #1 SMP PREEMPT Wed Nov 13 18:51:32 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
amavisd-new-postfix/xenial,xenial,now 1:2.10.1-2ubuntu1 all [installed]
postfix/xenial-updates,now 3.1.0-3ubuntu0.3 amd64 [installed]
postfix-mysql/xenial-updates,now 3.1.0-3ubuntu0.3 amd64 [installed]
postfix-pcre/xenial-updates,now 3.1.0-3ubuntu0.3 amd64 [installed]
postfix-policyd-spf-python/xenial,xenial,now 1.3.2-1 all [installed,automatic]
Instead of messing with a quarantine, I have my postfix installation configured to reject RBL and SPFFAIL e-mail. Unfortunately, I have a company that I need to receive e-mail from who has an incorrect SPF record that has been that way for some time. As such, instead of e-mail, I just get nice logs like this:
Apr 1 10:41:42 redacted postfix/smtpd[18833]: NOQUEUE: reject: RCPT from us-smtp-delivery-134.mimecast.com[216.205.24.134]: 550 5.7.1 : Recipient address rejected: Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=mfrom;id=redacted;ip=216.205.24.134;r=redacted; from=< redacted> to=< redacted> proto=ESMTP helo=< us-smtp-delivery-134.mimecast.com>
Said company doesn't have a contact that is likely to fix this on their website or in their WHOIS information (I assume a registrant @dnstinations.com [some third party vendor] is going to ignore an e-mail from a third party saying DNS is configured wrong).
The first time I got this log instead of an e-mail, I tried whitelisting *.mimecast.com, but that made no difference, so today, I took a look at my main.cf. I saw that the SPF configuration was on a different line than my whitelists, so I thought maybe I could make a separate spf-specific whitelist. Here is what my main.cf looked like before:
smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks, check_client_access regexp:/etc/postfix/rbl_client_regex, check_client_access hash:/etc/postfix/rbl_client_override, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl.sorbs.net
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_policy_service unix:private/policy-spf
smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/access, reject_unknown_sender_domain
Here is what it looks like now:
smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks, check_client_access regexp:/etc/postfix/rbl_client_regex, check_client_access hash:/etc/postfix/rbl_client_override, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl.sorbs.net
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, regexp:/etc/postfix/spf_client_regex, check_policy_service unix:private/policy-spf
smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/access, reject_unknown_sender_domain
Basically, all I did to the main.cf was add "regexp:/etc/postfix/spf_client_regex," before "check_policy_service unix:private/policy-spf" in the "smtpd_recipient_restrictions" section.
I also created /etc/postfix/spf_client_regex with this entry (this seems safe enough since mimecast is an antispam vendor):
/.*\.mimecast\.com$/ OK
I tested that with postmap -q, got the expected "OK" result, ran "postmap /etc/postfix/spf_client_regex" to update whatever that updates, and reloaded postfix. Unfortunately, mail from this sender continues to be blocked for SPF failures.
So, I expected the steps above to be correct considering that they're basically the same as the steps taken for the whitelist rules in smtpd_client_restrictions section that cause reject_rbl_client rules to be ignored, but it isn't working. So as stated in the title of this post: Can I Override SPF Policy Using a Whitelist? How?
regexp:/etc/postfix/spf_client_regex
may be a valid table designation... but you still have to pass it to an actual restriction command. You can find a list of of available restrictions here: postfix.org/postconf.5.html#smtpd_recipient_restrictions . Unfortunately, all of the ones which accept a table to parse relate to the recipient address and not the sender's address.