spfquery show fail for exists flags

[sandor]

Hi,
Our pmg installation says mailserver is not a designated for addresses which spf record has exists flag.
External online test tool say it must pass.
https://www.spf-record.com/spf-lookup/unicredit.eu?ip=207.54.76.27

The following commandalso show the fail on our server:

# spfquery -s test[at]unicredit.eu --ip-address 207.54.76.27
fail
Please see http://www.openspf.org/Why?s=mfrom;id=test%40unicredit.eu;ip=207.54.76.27;r=pmg.example.com
unicredit.eu: Sender is not authorized by default to use 'test[at]unicredit.eu' in 'mfrom' identity (mechanism '-all' matched)
Received-SPF: fail (unicredit.eu: Sender is not authorized by default to use 'test[at]unicredit.eu' in 'mfrom' identity (mechanism '-all' matched)) receiver=pmg.example.com; identity=mailfrom; envelope-from="test[at]unicredit.eu"; client-ip=207.54.76.27

And here is a tracking center log about a reject:

Jun 22 08:36:08 pmg postfix/smtpd[15715]: connect from esa11.hc437-5.eu.iphmx.com[207.54.72.196]
Jun 22 08:36:08 pmg postfix/smtpd[15715]: Anonymous TLS connection established from esa11.hc437-5.eu.iphmx.com[207.54.72.196]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Jun 22 08:36:08 pmg postfix/smtpd[15715]: NOQUEUE: reject: RCPT from esa11.hc437-5.eu.iphmx.com[207.54.72.196]: 554 5.7.1 <test[at]example.com>: Recipient address rejected: Rejected by SPF: 207.54.72.196 is not a designated mailserver for test%40unicredit.eu (context mfrom, on pmg.example.hu); from=<test[at]unicredit.eu> to=<test[at]example.com> proto=ESMTP helo=<esa11.hc437-5.eu.iphmx.com>
Jun 22 08:36:13 pmg postfix/smtpd[15715]: disconnect from esa11.hc437-5.eu.iphmx.com[207.54.72.196] ehlo=2 starttls=1 mail=1 rcpt=0/2 rset=1 quit=1 commands=6/8

I replace @ character for the post, and masquerade the real users but the original domain.

Is there config to enable the resolving of exist flags or what could be the problem?
Other SPF checks working well without exist.

 

[Stoiko Ivanov]

This reminds me a bit of:
https://forum.proxmox.com/threads/rejected-mail-but-spf-record-seems-to-be-ok.84888/#post-372856

check your dns-resolver - and see if you can correctly get the complete DNS record on your PMG

I hope this helps!

 

[sandor]

Yes, the problem was exactly the same i also use pfsense.
Thanks for your help!