Manual Reference Pages - POLICYD-SPF (1)
python-policyd-spf - pure-Python Postfix policy daemon for SPF checking
NOTE: Depending on the packaging and distribution, the exact path to the
executable may vary.
$ policyd-spf (Start using installed config file)
$ policyd-spf -h (Display usage message)
$ policyd-spf /usr/local/etc/postfix-policyd-spf-python/policyd-spf.conf (Config file name to use)
Configuration options are described in the sample configuration file provided
with the package (policyd-spf.conf.commented) and in policyd-spf.conf(5). The
provided setup.py installs an uncommented configuration file in
Additionally, whitelisting certain IP addresses or IP addresses used by listed
domains from SPF checks is supported. Skipping SPF checks for local submission
or trusted relays is also provided. The sample configuration file and
policyd-spf.conf(5) shows the format to use.
This documentation assumes you have read Postfixs README_FILES/
SMTPD_POLICY_README and are generally familiar with Sender Policy Framework
(SPF). See RFC 7208 for details.
See man 5 policyd-spf.conf for configuration file information.
man 5 policyd-spf.peruser provides documentation on setting up and using
different configuration options on a per user (mail reciepient) basis.
python-policyd-spf is a Postfix SMTPd policy daemon for SPF checking.
It is implemented in pure Python and uses the pyspf module. The SPF
web site is http://www.openspf.org/. The Postfix configuration must be
changed to check SPF.
Logging is sent to syslogd.
Each time a Postfix SMTP server process is started it connects to the policy
service socket and Postfix runs one instance of this Python script. By
default, a Postfix SMTP server process terminates after 100 seconds of idle
time, or after serving 100 clients. Thus, the cost of starting this Python
script is smoothed over time
The default policy_time_limit is 1000 seconds. This may be too short for some
SMTP transactions to complete. As recommended in SMTPD_POLICY_README, this
should be extended to 3600 seconds. To do so, set "policy_time_limit = 3600"
Messages that get a Fail SPF result will be rejected. Messages that get a
Permerror are, by default, treated as if they had no SPF record. Messages
that get a Temperror result are, by default, treated as if they had no SPF
record, but can (and probably should) be deferred if otherwise permitted.
Messages that get other SPF results (Pass, None, Neutral, Softfail) will have
the SPF Received header prepended. Note: Spamasassisn 3.2 and follow will use
this header for spam scoring so there is no need to configure a separate SPF
check in these Spamassassin versions. See Spamassassin documentation for
Default Mail From rejection/deferal criteria are, by design, conservative.
Default HELO check actions are to reject mail with other than Pass/None. HELO
records are much simpler than Mail From records and rejecting based on HELO
checking does not present a false positive risk. These settings are a matter
of local policy and should be adjusted to meet the requirements of site
administrators. See policyd-spf.conf(5) for configuration file details.
Policyd-spf will log messages to syslog about its activities. The "debugLevel"
value in "policyd-spf.conf" can be increased to get additional information to
be logged. When set to a value of "0", only test results (SPF hits/misses)
are logged. Results will be returned to Postfix and logged as a warning by
Postfix also. For logging by this policy server, look for "policyd-spf" in your
mail log files.
TESTING THE POLICY DAEMON
Testing the policy daemon
To test the policy daemon by hand, execute:
Each query is a bunch of attributes. Order does not matter, and the daemon
uses only a few of all the attributes shown below:
The policy daemon will answer in the same style, with an attribute list
followed by a empty line:
1. Add the following to /usr/local/etc/postfix/master.cf:
policyd-spf unix - n n - 0 spawn
NOTE: Check the path to both the installed Python interpreter and
policyd-spf. These vary from system to system. To use non-default
settings, you must also add the config file (see above and
policyd-spf.conf(5) for details). If you run other services with
user nobody, create a dedicated user for this policy server and use
2. Configure the Postfix policy service in /usr/local/etc/postfix/main.cf:
policyd-spf_time_limit = 3600
NOTE: Specify check_policy_service AFTER reject_unauth_destination or
else your system can become an open relay.
3. Reload Postfix.
policyd-spf.conf(5), policyd-spf.peruser(5), python-spf,
<http://www.openspf.org>, RFC 7208
This version of python-policyd-spf was written by Copyright © 2007-2012
Scott Kitterman <email@example.com>. It is derived from Tumgreyspf,
written by Sean Reifschneider, tummy.com, ltd <firstname.lastname@example.org>. Portions of
the documentation were written by Meng Weng Wong <email@example.com>.
This man-page was created by Scott Kitterman <firstname.lastname@example.org>.
|--> ||POLICY-SPF (1) ||2012-03-17 |
Visit the GSP FreeBSD Man Page Interface.
Output converted with manServer 1.07.