Mail Delivery Without SPF.

[abhishekgirme]

We had a situation where PMG accepted emails though sender domain which had no valid SPF.

For many months, it continued to accept emails and deliver. The only change was, sender domain changed their name servers recently and caused mail delivery failure at our end.

PMG is configured to look for valid SPF and reject if sender domain has no valid SPF. When we checked email header of old mails, we can see that SPF helo none (SPF_HELO_NONE(0.001),SPF_NONE(0.001).

I would like to understand reason for this behavior.

 

[Stoiko Ivanov]

We had a situation where PMG accepted emails though sender domain which had no valid SPF.

This is usually the wanted behavior with no SPF record or a broken one?

please share the logs and explain which mail got devliered, but should not have been delivered (or which mail was not delivered but should have been delivered)

 

[abhishekgirme]

Looks like a bug to me.. if SPF check is mandated then it should reject the email.

SPF_HELO_NONE(0.001),SPF_NONE(0.001) is seen in header. Let me get some logs for you.

 

[Stoiko Ivanov]

Looks like a bug to me.. if SPF check is mandated then it should reject the email.

Not really - quite many domains do not publish a SPF record - e-mail would not work in general if you reject all those mails.
I would really recommend against this.

Should you still wish to do so (maybe because you're really sure that all domains you are receiving mails from do have a valid SPF record) you can always increase the score of the SPF Spamassassin rules:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_spamdetector_customscores

I hope this helps!

 

[abhishekgirme]

If that is the case, why it started rejecting emails later?

Could you please help with exact syntax for SPF rule. Thank you.

 

[Stoiko Ivanov]

as said for this we'd need the logs of a mail which passed from that sender, and of one which was rejected