vesely at tana
Nov 14, 2009, 3:51 AM
Post #3 of 3
(598 views)
Permalink
|
Tim Kloos wrote:
> I've been researching spf and spamassassin recently. It appears that
> the only way to implement spf with spamassassin is to make entries for
> each domain that we want to check the spf records for.
SpamAssassin uses SPF rather differently than it was intended to. SPF
is meant as a tool to accept/reject mail at an early stage in the SMTP
dialog, while SA is meant to be run after the body of the message has
been received.
> I thought that
> for every email we receive the spf record would be checked by telling
> spamassassin to do so - but perhaps that would require too much
> overhead.
SPF checking can be done early, as designed, possibly rejecting some
messages. SA is able to reuse SPF-Received header fields that the
receiving server had added to accepted messages. However, if no SPF
lookup had been done, SA can do it by itself.
> Any observations? Unfortunately, going through the
> spamassassin and spf documentation for me can be a bit like reading
> greek sometimes.
Messages having an SPF /pass/ are not necessarily ham. SPF only
guarantees that the message has been received from an authorized IP
address. In case you trust domain example.com, you may configure SA with
whitelist_from_spf *@example.com
That way, if example.com has an SPF policy ending in "?all", your
server will not reject messages whose envelope sender matches;
however, they will still be subject to SA filtering unless they got a
/pass/.
-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com
|
