{"action":"created","issue":{"url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/760","repository_url":"https://api.github.com/repos/mail-in-a-box/mailinabox","labels_url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/760/labels{/name}","comments_url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/760/comments","events_url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/760/events","html_url":"https://github.com/mail-in-a-box/mailinabox/pull/760","id":141355572,"number":760,"title":"Apply SPF policy checks to incoming email","user":{"login":"yodax","id":5643940,"avatar_url":"https://avatars.githubusercontent.com/u/5643940?v=3","gravatar_id":"","url":"https://api.github.com/users/yodax","html_url":"https://github.com/yodax","followers_url":"https://api.github.com/users/yodax/followers","following_url":"https://api.github.com/users/yodax/following{/other_user}","gists_url":"https://api.github.com/users/yodax/gists{/gist_id}","starred_url":"https://api.github.com/users/yodax/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yodax/subscriptions","organizations_url":"https://api.github.com/users/yodax/orgs","repos_url":"https://api.github.com/users/yodax/repos","events_url":"https://api.github.com/users/yodax/events{/privacy}","received_events_url":"https://api.github.com/users/yodax/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2016-03-16T18:10:44Z","updated_at":"2016-06-04T06:06:50Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mail-in-a-box/mailinabox/pulls/760","html_url":"https://github.com/mail-in-a-box/mailinabox/pull/760","diff_url":"https://github.com/mail-in-a-box/mailinabox/pull/760.diff","patch_url":"https://github.com/mail-in-a-box/mailinabox/pull/760.patch"},"body":"I saw this on the forums or as an issue, but I can't find that anymore so I can't credit the original poster. \r\n\r\nThis PR will apply SPF policy checking on incoming email. \r\n\r\nPolicy SPF will check the if the sender has configured an SPF record on the domain.\r\nThis record contains the address of the smtp server(s) that is allowed to send email on behalf of this domain. If that doesn't match with the server sending us email, the message will be rejected.\r\n\r\nThis change should help fight spam. \r\n\r\nI have tested this with a fake mailer: https://emkei.cz. On a plain MIAB the message being send from this service will arrive once they get past postgrey. The from address I used has an SPF record on the domain.\r\n\r\nAfter the changes the messages get bounced. The recipient is notified of the bounce and the reason why.\r\n\r\nMessage in /var/log/mail.log:\r\n`Mar 16 18:43:25 box postfix/smtpd[15671]: NOQUEUE: reject: RCPT from emkei.cz[46.167.245.72]: 550 5.7.1 <DESTEMAIL>: Recipient address rejected: Message rejected due to: SPF fail - not authorized. Please see http://www.openspf.net/Why?s=mfrom;id=FROMMAIL;ip=46.167.245.72;r= DESTEMAIL; from=< FROMMAIL> to=< DESTEMAIL > proto=ESMTP helo=<emkei.cz>\r\nMar 16 18:43:25 box postfix/smtpd[15671]: disconnect from emkei.cz[46.167.245.72]`\r\n\r\nThe message the sender gets is: ```Recipient address rejected: Message rejected due to:\r\n   SPF fail - not authorized. Please see\r\n   http://www.openspf.net/Why?s=mfrom;id=**;ip=46.167.245.72;r=**```\r\n\r\nMessages send with the authorized smtp server do arrive and so do messages without an spf record associated with the domain. \r\n\r\nGreylisting still works as well after the change."},"comment":{"url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/comments/223738960","html_url":"https://github.com/mail-in-a-box/mailinabox/pull/760#issuecomment-223738960","issue_url":"https://api.github.com/repos/mail-in-a-box/mailinabox/issues/760","id":223738960,"user":{"login":"yodax","id":5643940,"avatar_url":"https://avatars.githubusercontent.com/u/5643940?v=3","gravatar_id":"","url":"https://api.github.com/users/yodax","html_url":"https://github.com/yodax","followers_url":"https://api.github.com/users/yodax/followers","following_url":"https://api.github.com/users/yodax/following{/other_user}","gists_url":"https://api.github.com/users/yodax/gists{/gist_id}","starred_url":"https://api.github.com/users/yodax/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yodax/subscriptions","organizations_url":"https://api.github.com/users/yodax/orgs","repos_url":"https://api.github.com/users/yodax/repos","events_url":"https://api.github.com/users/yodax/events{/privacy}","received_events_url":"https://api.github.com/users/yodax/received_events","type":"User","site_admin":false},"created_at":"2016-06-04T06:06:50Z","updated_at":"2016-06-04T06:06:50Z","body":"Thanks everybody for the constructive comments :smile: Looking at the posts above, shall I close this PR?\r\n\r\nIt might be good to focus on the comment of @ned14. If found [this](http://jimsun.linxnet.com/misc/postfix-anti-UCE.txt) post which details some of the configuration necessary. "}}
{"actor":{"display_login":"yodax"}}