Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of our clients is getting mail rejected from one of his customers. The sender's SPF record is:

v=spf1 +a +mx +ip4: ?all

The mail is not originating from, but AFAIU the '?all' means my mail server (postfix) should accept it. Is that correct?

Can I change my '/etc/postfix-policyd-spf-python/policyd-spf.conf' to make it accept these emails, and if so how?

Should I do this?

FWIW the message in py error log is:

Message rejected due to: access neither permitted nor denied.

Thanks in advance.


My SPF policy was:

HELO_reject = SPF_Not_Pass
Mail_From_reject = Fail

The mail was being rejected at the HELO stage, which I've changed now to 'Fail'.

share|improve this question
Please update this with the relevant parts of your policy if you still cannot resolve this issue. Also verify the SPF record can be resolved from your MTA server. – jeffatrackaid May 20 '13 at 14:16
up vote 6 down vote accepted

The mail is not originating from, but AFAIU the '?all' means my mail server (postfix) should accept it. Is that correct?

Yes, but not should, just intended

From here, you can see that Neutral means The SPF record specifies explicitly that nothing can be said about validity

But the default SPF policy from postfix is that:

HELO_reject = SPF_Not_Pass

means the postfix will reject HELO if SPF check not pass ( i.e Fail, Softfail, Hardfail...)

You can change postfix SPF policy to accept email even SPF check fail.

share|improve this answer
I think the default policies vary by distribution don't they? – jeffatrackaid May 20 '13 at 14:17
No, every postfix version I have used also have the same default SPF policy is HELO_reject = SPF_Not_Pass – cuonglm May 20 '13 at 14:20
So in this case, where I want this mail to come through, but still want some level of protection I'd want to use Fail for this setting? – DaedalusFall May 21 '13 at 10:01
No, if you want some protection, please make SPF check pass. But you should remember, SPF (or DKIM) is only optional on testing spam mail. As far as I know, the important when checking mail spam is blacklist, contetn-encoding (7-bit), PTR record. – cuonglm May 21 '13 at 10:11
Sorry, when you say 'please make SPF check pass' you mean set HELO_reject to SPF_Not_Pass` (as it currently is?), or do you mean I should accept mail (at this stage) no matter what the SPF, and let later parts of the system (eg amavis) sort it all out? – DaedalusFall May 21 '13 at 10:19

You are on the right track. The inclusion of the ?all policy is simply stating a preference on how the sender wishes the mail to be handled. How it is actually handled is determined by your system.

You have not posted your policy but you can set it to allow this domain or this condition by modifying your policy.


Note some policy conditions will reject email if the SPF cannot be determined (e.g. formatting error with the SPF record itself or DNS issue).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.