<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";
mso-fareast-language:EN-ZA;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-fareast-language:EN-US;}
span.EmailStyle23
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-ZA" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">As a follow up, I found a difference in the way that my Mailscanner implementation was behaving, vs a mailborder implementation. With Mailscanner, the mail was accepted, and then handed over to spamasassin, where the spamassassin rules
would trigger and then cause the email to be tagged as spam. In the case of Mailborder, as soon as the “From:” point in the protocol was reached, the process would stop and the mail got rejected. I was trying to understand why they were behaving differently;
but the Spamassassin approach works so I guess I found a solution, and learned a bit more about SPF in the process. Hopefully this will help someone else. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here’s the transcript of what happens:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText">I was running a hand crafted SMTP transaction to test whether SPF tests were being implemented correctly on two different servers. The server I was testing from is not allowed to send mail for this domain (mindspring.co.za) via either
server, i.e. mailmaster.mindspring.co.za, or mb1.mindspring.co.za. In the case of the mailmaster server, the mail is accepted by postfix, even though it fails SPF checks. For the second server, viz. mb1.mindspring.co.za, as soon as I submit the "From", it
gets rejected by SPF. Is this possibly the mb1 servers is using a newer version of SPF or is this a configuration issue ?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I did subsequently find that the SPF checks are working on the first server that seemed to accept the mail (mailmaster.mindspring.co.za), but it got handed to Spamassassin that then rejected the mail because of SPF.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">============ Start of transaction on Server Running Mailscanner ===================<o:p></o:p></p>
<p class="MsoPlainText">$ telnet mailmaster.mindspring.co.za 25<o:p></o:p></p>
<p class="MsoPlainText">Trying 197.155.22.89...<o:p></o:p></p>
<p class="MsoPlainText">Connected to mailmaster.mindspring.co.za.<o:p></o:p></p>
<p class="MsoPlainText">Escape character is '^]'.<o:p></o:p></p>
<p class="MsoPlainText">220 mailmaster.mindspring.co.za ESMTP Postfix <o:p></o:p></p>
<p class="MsoPlainText">ehlo mindspring.co.za <o:p></o:p></p>
<p class="MsoPlainText">250-mailmaster.mindspring.co.za <o:p></o:p></p>
<p class="MsoPlainText">250-PIPELINING <o:p></o:p></p>
<p class="MsoPlainText">250-SIZE 20971520 <o:p></o:p></p>
<p class="MsoPlainText">250-VRFY <o:p></o:p></p>
<p class="MsoPlainText">250-ETRN <o:p></o:p></p>
<p class="MsoPlainText">250-STARTTLS <o:p></o:p></p>
<p class="MsoPlainText">250-AUTH PLAIN LOGIN <o:p></o:p></p>
<p class="MsoPlainText">250-ENHANCEDSTATUSCODES <o:p></o:p></p>
<p class="MsoPlainText">250-8BITMIME<o:p></o:p></p>
<p class="MsoPlainText">250 DSN<o:p></o:p></p>
<p class="MsoPlainText">mail from: <a href="mailto:user@mindspring.co.za">user@mindspring.co.za</a><o:p></o:p></p>
<p class="MsoPlainText">250 2.1.0 Ok<o:p></o:p></p>
<p class="MsoPlainText">rcpt to: <a href="mailto:user@mindspring.co.za">user@mindspring.co.za</a><o:p></o:p></p>
<p class="MsoPlainText">250 2.1.5 Ok<o:p></o:p></p>
<p class="MsoPlainText">data<o:p></o:p></p>
<p class="MsoPlainText">354 End data with <CR><LF>.<CR><LF><o:p></o:p></p>
<p class="MsoPlainText">subject: test<o:p></o:p></p>
<p class="MsoPlainText">1<o:p></o:p></p>
<p class="MsoPlainText">.<o:p></o:p></p>
<p class="MsoPlainText">250 2.0.0 Ok: queued as D6A1743AD04A<o:p></o:p></p>
<p class="MsoPlainText">quit<o:p></o:p></p>
<p class="MsoPlainText">221 2.0.0 Bye<o:p></o:p></p>
<p class="MsoPlainText">Connection closed by foreign host.<o:p></o:p></p>
<p class="MsoPlainText">============ End of transaction on Server Running Mailscanner ===================<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">============ Start of transaction on Server Running Mailborder ===================<o:p></o:p></p>
<p class="MsoPlainText">telnet mb1.mindspring.co.za 25<o:p></o:p></p>
<p class="MsoPlainText">Trying 178.79.131.19...<o:p></o:p></p>
<p class="MsoPlainText">Connected to mb1.mindspring.co.za.<o:p></o:p></p>
<p class="MsoPlainText">Escape character is '^]'.<o:p></o:p></p>
<p class="MsoPlainText">220 mail.mb1.mindspring.co.za ESMTP<o:p></o:p></p>
<p class="MsoPlainText">ehlo mindspring.co.za<o:p></o:p></p>
<p class="MsoPlainText">250-mail.mb1.mindspring.co.za<o:p></o:p></p>
<p class="MsoPlainText">250-PIPELINING<o:p></o:p></p>
<p class="MsoPlainText">250-SIZE 52428800<o:p></o:p></p>
<p class="MsoPlainText">250-ETRN<o:p></o:p></p>
<p class="MsoPlainText">250-STARTTLS<o:p></o:p></p>
<p class="MsoPlainText">250-ENHANCEDSTATUSCODES<o:p></o:p></p>
<p class="MsoPlainText">250-8BITMIME<o:p></o:p></p>
<p class="MsoPlainText">250-DSN<o:p></o:p></p>
<p class="MsoPlainText">250 SMTPUTF8<o:p></o:p></p>
<p class="MsoPlainText">mail from: <a href="mailto:user@mindspring.co.za">user@mindspring.co.za</a><o:p></o:p></p>
<p class="MsoPlainText">250 2.1.0 Ok<o:p></o:p></p>
<p class="MsoPlainText">rcpt to: <a href="mailto:user@mindspring.co.za">user@mindspring.co.za</a><o:p></o:p></p>
<p class="MsoPlainText">550 5.7.23 <<a href="mailto:user@mindspring.co.za">user@mindspring.co.za</a>>: Recipient address rejected: Message rejected due to: SPF fail - not authorized. Please see
<a href="http://www.openspf.net/Whys=helo;id=mindspring.co.za;ip=88.80.187.207;r=%3cUNKNOWN">
http://www.openspf.net/Whys=helo;id=mindspring.co.za;ip=88.80.187.207;r=<UNKNOWN</a>><o:p></o:p></p>
<p class="MsoPlainText">============ End of transaction on Server Running Mailscanner ===================<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="mso-fareast-language:EN-ZA">From:</span></b><span lang="EN-US" style="mso-fareast-language:EN-ZA"> MailScanner <mailscanner-bounces+pramod=mindspring.co.za@lists.mailscanner.info>
<b>On Behalf Of </b>Shawn Iverson via MailScanner<br>
<b>Sent:</b> Saturday, 05 February 2022 21:36<br>
<b>To:</b> mailscanner@lists.mailscanner.info<br>
<b>Cc:</b> Shawn Iverson <shawniverson@summitgrid.com><br>
<b>Subject:</b> Re: SPF checks on Mailscanner<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Since this is concerning pypolicyd-spf and python-pyspf, unless somehow MailScanner is at play here, I don't think this is a MailScanner issue. Can you bypass MailScanner and test again?<span style="mso-fareast-language:EN-ZA"><o:p></o:p></span></p>
<div>
<p class="MsoNormal">On 2/5/22 11:13, Pramod Daya via MailScanner wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi Folks,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Running MailScanner 5.3.4-3 on Centos 7, I’m using, for SPF checking:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">pypolicyd-spf-1.3.2-5.el7.noarch<o:p></o:p></p>
<p class="MsoNormal">python-pyspf-2.0.14-13.el7.noarch<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Using these policyd-spf.conf settings:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">debugLevel = 2<o:p></o:p></p>
<p class="MsoNormal">defaultSeedOnly = 1<o:p></o:p></p>
<p class="MsoNormal">HELO_reject = SPF_Not_pass<o:p></o:p></p>
<p class="MsoNormal">Mail_From_reject = Fail<o:p></o:p></p>
<p class="MsoNormal">PermError_reject = False<o:p></o:p></p>
<p class="MsoNormal">TempError_Defer = False<o:p></o:p></p>
<p class="MsoNormal">skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Which seems to work fine, as it issues warnings to servers that aren’t authorised to send for domains that don’t have SPF records set up correctly. However, when I do a command line test from a remote (unauthorised) server to send mail
through this server, it happily accepts the mail, even though the unauthorised server is not in the SPF list. The sending server is not whitelisted, I can’t understand why it doesn’t get rejected by the SPF check.
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Some advice or pointers would be greatly appreciated. <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thank you.<o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr style="height:4.8pt">
<td width="501" colspan="2" valign="top" style="width:376.1pt;padding:0cm 5.4pt 0cm 5.4pt;height:4.8pt">
<p class="MsoNormal" style="line-height:105%"><b><span style="font-size:10.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">___________________________________________________</span></b><o:p></o:p></p>
</td>
</tr>
<tr style="height:4.8pt">
<td width="293" valign="top" style="width:219.75pt;padding:0cm 5.4pt 0cm 5.4pt;height:4.8pt">
<p class="MsoNormal" style="line-height:105%"><b><span style="font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">Pramod Daya</span></b><i><span style="font-size:7.0pt;line-height:105%;font-family:"Verdana",sans-serif;color:blue;mso-fareast-language:EN-ZA">
(</span></i><span style="font-size:7.0pt;line-height:105%;font-family:"Verdana",sans-serif;color:blue;mso-fareast-language:EN-ZA">CEO)</span><o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><i><span style="font-size:7.0pt;line-height:105%;font-family:"Verdana",sans-serif;color:blue;mso-fareast-language:EN-ZA">M.Sc. Computer Science (U. of Oregon)</span></i><o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><span style="font-size:9.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">Unit 5, Melomed Office Park</span><o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><span style="font-size:9.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">Punters Way, Kenilworth</span><o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><span style="font-size:9.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">Cape Town, South Africa 7708</span><o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><span style="mso-fareast-language:EN-ZA"><a href="http://www.mindspring.co.za/"><span style="font-size:10.0pt;line-height:105%;font-family:"Verdana",sans-serif;color:#0563C1">www.mindspring.co.za</span></a></span><o:p></o:p></p>
</td>
<td width="208" valign="top" style="width:156.35pt;padding:0cm 5.4pt 0cm 5.4pt;height:4.8pt">
<p class="MsoNormal" align="right" style="text-align:right;line-height:105%"><b><span style="font-size:10.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">
</span></b><span style="font-size:10.0pt;line-height:105%;font-family:"Verdana",sans-serif;color:blue;mso-fareast-language:EN-ZA"><img border="0" width="124" height="30" style="width:1.2916in;height:.3125in" id="Picture_x0020_8" src="cid:image001.png@01D826AB.2ABF8FD0"></span><o:p></o:p></p>
<p class="MsoNormal" align="right" style="text-align:right;line-height:105%"><b><span style="font-size:9.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">Work:
</span></b><span style="font-size:9.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA"> +27 21 657 1780</span><o:p></o:p></p>
<p class="MsoNormal" align="right" style="text-align:right;line-height:105%"><b><span style="font-size:9.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">Fax:
</span></b><span style="font-size:9.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">+27 21 671 7599</span><o:p></o:p></p>
<p class="MsoNormal" align="right" style="text-align:right;line-height:105%"><b><span style="font-size:9.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA"> Cell:</span></b><span style="font-size:9.0pt;line-height:105%;font-family:"Verdana",sans-serif;mso-fareast-language:EN-ZA">
+27 83 675 0367</span><o:p></o:p></p>
<p class="MsoNormal" align="right" style="text-align:right;line-height:105%"><span style="font-size:10.0pt;line-height:105%;font-family:"Verdana",sans-serif;color:blue;mso-fareast-language:EN-ZA"><a href="mailto:pramod@mindspring.co.za">pramod@mindspring.co.za</a></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="color:black;mso-fareast-language:EN-ZA"> </span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-ZA"><br>
<br>
<o:p></o:p></span></p>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
</blockquote>
</div>
</body>
</html>