One of our clients is getting mail rejected from one of his customers. The sender's SPF record is:

v=spf1 +a +mx +ip4: ?all

The mail is not originating from, but AFAIU the '?all' means my mail server (postfix) should accept it. Is that correct?

Can I change my '/etc/postfix-policyd-spf-python/policyd-spf.conf' to make it accept these emails, and if so how?

Should I do this?

FWIW the message in py error log is:

Message rejected due to: access neither permitted nor denied.

Thanks in advance.


My SPF policy was:

HELO_reject = SPF_Not_Pass
Mail_From_reject = Fail

The mail was being rejected at the HELO stage, which I've changed now to 'Fail'.

  • Please update this with the relevant parts of your policy if you still cannot resolve this issue. Also verify the SPF record can be resolved from your MTA server. – jeffatrackaid May 20 '13 at 14:16

The mail is not originating from, but AFAIU the '?all' means my mail server (postfix) should accept it. Is that correct?

Yes, but not should, just intended

From here, you can see that Neutral means The SPF record specifies explicitly that nothing can be said about validity

But the default SPF policy from postfix is that:

HELO_reject = SPF_Not_Pass

means the postfix will reject HELO if SPF check not pass ( i.e Fail, Softfail, Hardfail...)

You can change postfix SPF policy to accept email even SPF check fail.

  • I think the default policies vary by distribution don't they? – jeffatrackaid May 20 '13 at 14:17
  • No, every postfix version I have used also have the same default SPF policy is HELO_reject = SPF_Not_Pass – cuonglm May 20 '13 at 14:20
  • So in this case, where I want this mail to come through, but still want some level of protection I'd want to use Fail for this setting? – DaedalusFall May 21 '13 at 10:01
  • No, if you want some protection, please make SPF check pass. But you should remember, SPF (or DKIM) is only optional on testing spam mail. As far as I know, the important when checking mail spam is blacklist, contetn-encoding (7-bit), PTR record. – cuonglm May 21 '13 at 10:11
  • Sorry, when you say 'please make SPF check pass' you mean set HELO_reject to SPF_Not_Pass` (as it currently is?), or do you mean I should accept mail (at this stage) no matter what the SPF, and let later parts of the system (eg amavis) sort it all out? – DaedalusFall May 21 '13 at 10:19

You are on the right track. The inclusion of the ?all policy is simply stating a preference on how the sender wishes the mail to be handled. How it is actually handled is determined by your system.

You have not posted your policy but you can set it to allow this domain or this condition by modifying your policy.

See: http://manpages.ubuntu.com/manpages/lucid/man5/policyd-spf.conf.5.html

Note some policy conditions will reject email if the SPF cannot be determined (e.g. formatting error with the SPF record itself or DNS issue).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.