SPF check for relayed mail

[William Edwards]

When using PMG as an SMTP relay, I want the SPF check to be skipped for mail offered to the internal SMTP port; only the PMG servers are specified in SPF records, not the internal host using the PMG smarthost.

I can of course add custom SpamAssassin rules for this, but before I do that, I'd like to know what the "Mail Proxy" -> "Options" -> "Use SPF" option does. I couldn't find a description in the documentation.

 

[Stoiko Ivanov]

SPF checking in PMG happens on 2 distinct levels:
a) in the Mail Proxy (which is configured by the "Use SPF" checkbox you mentioned)
b) by SpamAssassin, when a mail passes the rule-system

for a) mails don't get passed through the SPF (and greylist) checks if they arrive on the internal port (default 26)
for b) you'd need to either configure your DNS so that it provides a different SPF record to spamassassin, or adapt the scores for the SPF rules from spamassassin

I hope this explains it!

 

[William Edwards]

for a) mails don't get passed through the SPF (and greylist) checks if they arrive on the internal port (default 26)

What do you mean by "checks if they arrive on the internal port (default 26)"? Does it do or not do the SPF check when 'Use SPF' is disabled on the internal port or the external port?

Context: I set "Use SPF" to "No", but am still seeing "Recipient address rejected: Rejected by SPF:" for mail sent to the internal port.

 

[Stoiko Ivanov]

Context: I set "Use SPF" to "No", but am still seeing "Recipient address rejected: Rejected by SPF:" for mail sent to the internal port.

* This sounds odd - would you please share an example e-mail-log for such a mail? (AFAIR you should also see messages from pmgpolicy if it is the source of the reject)
* if this is a clustered system - is the cluster in sync?

 

[William Edwards]

Looks like /etc/pmg/pmg.conf is out of sync on one cluster node (which happens to be the one I'm testing on), indeed... Not an issue for this topic.

 

[Stoiko Ivanov]

Looks like /etc/pmg/pmg.conf is out of sync on one cluster node (which happens to be the one I'm testing on), indeed... Not an issue for this topic.

I assume that the SPF works as planned once the config is in sync ?
regarding the cluster-sync not being in sync - you could open a new thread (or we can continue here) - unless the source of the problem is clear

 

[William Edwards]

I assume that the SPF works as planned once the config is in sync ?
regarding the cluster-sync not being in sync - you could open a new thread (or we can continue here) - unless the source of the problem is clear

Yes, just fixed the clustering situation. 'Use SPF' is now disabled on all nodes, and works as expected.

Thank you!

 

[Stoiko Ivanov]

Glad that worked!

Out of curiosity - what caused the cluster to run out of sync? (currently considering a few small improvements in that area)

Thanks!

 

[William Edwards]

Glad that worked!

Out of curiosity - what caused the cluster to run out of sync? (currently considering a few small improvements in that area)

Thanks!

Node A thought node B was master. Node B thought node B was master. Node C thought node C was master...