WhyAs a way to fight spam, information about who is entitled to send email for a particular domain will be attached to it using the DNS as a way to publish the information.
- RFC: RFC 7208
Every record on these pages ends in ~all
(softfail) rather than -all (fail), and that is a choice about
copying rather than about policy: a record published before the list of
senders is complete will refuse your own mail if it ends in
-all, where ~all only marks it. -all
is where the record should end up. Change it once you are sure the record
names every host that sends for the domain — including anything that
forwards on your behalf, which fails SPF from the forwarder's own address
unless it rewrites the sender.
Configuration
SPF allow to indicate the hosts (ie: their IPs) allowed to send mail for a particular domain. This is to prevent spam being sent through an external machine using your email address as the address of the sender.
The following example specifies to the different mail servers that
the mrelay1.example.com host is the one entitled to send messages
whose sender address is of the form @example.com.
Domain IN TXT "v=spf1 a:mrelay1.example.com ~all" Mail server IN TXT "v=spf1 a ~all"
The policy is published as a TXT record, not under the
dedicated SPF type (99) that once existed for it.
RFC 7208
§3.1 requires TXT: the separate type was defined during
SPF’s experimental phase and dropped once it was clear resolvers and
registrars would not adopt it. Publishing both is not an error, but it
gains nothing and gives the two copies a chance to drift apart.
Integration
Postfix
Postfix isn’t build any more with postfix-libspf2 patch, the following section is obsolete.
SPF verifies the legitimacy of the machine sending the mail, this
verification is performed (through the SPF DNS records) when
receiving the mail using reject_spf_invalid_sender in
the smtpd_sender_restrictions definition:
smtpd_sender_restrictions =
...
reject_spf_invalid_sender,
...
In addition, a white list maintained by trusted-forwarder.org. will
be checked (directive spf_global_whitelist). Mail headers will also
be modified to show the validation results (directive
spf_received_header). If validation failed the mail will be rejected
(except if the spf_mark_only directive is set up) and the error
message will show the explanation described by spf_explanation.
# SPF
spf_received_header = yes
spf_mark_only = yes
spf_explanation = "%{h} [%{i}] is not allowed to send mail for %{s}"
spf_global_whitelist = yes