postfix-policyd-spf-perl(1) pure-Perl Postfix policy server for SPF checking




postfix-policyd-spf-perl is a Postfix SMTP policy server for SPF checking. It is implemented in pure Perl and uses the Mail::SPF CPAN module. Note that Mail::SPF is a complete re-implementation of SPF based on the final experimental SPF RFC, RFC 4408. It shares no code with the older Mail::SPF::Query that was the original SPF development implementation. Mail::SPF was the inspiration for the new void lookup limit added in the standards track SPF RFC, RFC 7208. While Mail::SPF has not yet been specifically updated for RFC 7208, there are no significant changes needed.

This version of the policy server always checks HELO before Mail From (older versions just checked HELO if Mail From was null). It will reject mail that fails either Mail From or HELO SPF checks. It will defer mail if there is a temporary SPF error and the message would othersise be permitted (DEFER_IF_PERMIT). If the HELO check produces a REJECT/DEFER result, Mail From will not be checked.

If the message is not rejected or deferred, the policy server will PREPEND the appropriate SPF Received header. If Mail From is anything other than completely empty (i.e. <>) then the Mail From result will be used for SPF Received (e.g. Mail From None even if HELO is Pass).

The policy server skips SPF checks for connections from the localhost (127.) and instead prepends and logs 'SPF skipped - localhost is always allowed.' If you have relays that you want to skip SPF checks for, you can add them to relay_addresses on line 78 using standard CIDR notation in a space separated list. For these addresses, 'X-Comment: SPF skipped for whitelisted relay' is prepended and logged.

Error conditions within the policy server (that don't result in a crash) or from Mail::SPF will return DUNNO.