Sender Policy Framework

Sender Policy Framework and Postfix

In addition to an A Record, MX and PTR record, mail servers (MTA) also require an SPF record in DNS.

What are SPF Records

Sender Policy Framework (SPF) is a method of sender authentication. Like DKIM, SPF is a TXT data set of DNS that is designed to help prevent email spoofing and identify it as legitimate when delivering your own emails. Also, the e-mail is not to be prevented from ending up in the junk e-mail folder at the recipient. If a domain is abused by e-mail spoofing, the emails are likely to end up in the recipient’s spam folder.

The SPF record specifies which hosts or IP addresses are allowed to send e-mail on behalf of a domain. You should only allow your own mail server or your ISP server to send e-mail for this domain.

Create SPF record in DNS

An SPF record is a DNS record that is added to a domain’s DNS zone. The SPF record in a DNS zone can look like this:

When managing the domain of an Internet web hosting provider, this may look something like this.

  • TXT indicates that this is a TXT record.
  • v=spf1 indicates that this is an SPF record and the SPF record version is SPF1.
  • mx means that all hosts listed in the MX records are allowed to send emails for the domain, all other hosts are not allowed.
  • All indicates that emails from this domain should only come from hosts specified in the SPF record. Emails sent by other hosts are flagged as fake. Possible alternatives are +all, -all, but these are rarely used.

To verify that the SPF record is resolved on the public Internet, the dig utility on the Linux host should be used for querying as follows:

On a Windows computer, nslookup can be run in a command prompt (cmd), the change may be delayed depending on the TTL:

In the PowerShell, Resolve-DnsName is used with the following command:

Online SPF validators such as mxtoolbox can also be used to check which hosts are allowed to send the emails of their own domain.

Postfix SPF Policy Agent pypolicyd-spf

For our Postfix SMTP server, we still need an instruction to check the SPF record of incoming emails to detect fake emails. To do this, install the pypolicyd-spf package from the EPEL repository as root:

Then add a user for Policyd SPF:

Now edit the postfix master configuration file master.cf:

Add the lines at the end of the file master.cf, instructing Postfix to start the SPF policy demon. Policyd-SPF runs as a user policyd-spf.

  Policyd SPF should not run in a chroot environment.

Save and close the file. Next, edit the postfix main configuration file main.cf:

The line with policyd-spf should come to reject_unauth_destination to stand. Save the file and then restart Postfix:

The next time an email is received from your domain with an SPF record, the SPF check results are displayed in the raw email header. The following header indicates that the sender of the email was sent by an authorized host.

Postfix logs the SPF check results in maillog with syslog as follows.

Leave a Reply

Your email address will not be published. Required fields are marked *