postfix-policyd-spf-perl1

Usage

Version

2.011

Usage

Usage:
policyd-spf-perl [-v]

Other documentation

This documentation assumes you have read Postfix's README_FILES/ SMTPD_POLICY_README.

Overview

Logging is sent to syslogd.

Each time a Postfix SMTP server process is started it connects to the policy service socket and Postfix runs one instance of this Perls script. By default, a Postfix SMTP server process terminates after 100 seconds of idle time, or after serving 100 clients. Thus, the cost of starting this Perl script is smoothed over time.

The default policy_time_limit is 1000 seconds. This may be too short for some SMTP transactions to complete. As recommended in SMTPD_POLICY_README, this should be extended to 3600 seconds. To do so, set "policy_time_limit = 3600" in /etc/postfix/main.cf.

Testing the policy daemon

Testing the policy daemon

To test the policy daemon by hand, execute:

% /usr/sbin/postfix-policyd-spf-perl

Each query is a bunch of attributes. Order does not matter, and the server uses only a few of all the attributes shown below:

request=smtpd_access_policy
protocol_state=RCPT
protocol_name=SMTP
helo_name=some.domain.tld
queue_id=
instance=71b0.45e2f5f1.d4da1.0
[email protected]
[email protected]
client_address=1.2.3.4
client_name=another.domain.tld
[empty line]

The policy daemon will answer in the same style, with an attribute list followed by a empty line:

action=550 Please see http://www.openspf.org/[email protected]&ip=1.2.3.4&
[email protected]
[empty line]

To test HELO checking sender should be empty:

sender=
... More attributes...
[empty line]

If you want more detail in the system logs change $VERBOSE to 1.

Postfix integration

1. Add the following to /etc/postfix/master.cf:

spfcheck unix - n n - 0 spawn
user=policyd-spf argv=/usr/sbin/postfix-policyd-spf-perl

2. Configure the Postfix SPF policy service in /etc/postfix/main.cf:

smtpd_recipient_restrictions =
...
reject_unauth_destination
check_policy_service unix:private/spfcheck
...
spfcheck_time_limit = 3600

NOTE: Specify check_policy_service AFTER reject_unauth_destination or
else your system can become an open relay.

3. Set up machines which you expect to legitimately forward mail to this
server (see description in synopsis). This should typically include
the IP addresses which backup Mail eXchangers, and known non-SRS
forwarders will use to submit mail to this server (i.e. the source IPs
of the other servers).

4. Restart Postfix.

5. Verify correct backup MX operation (if applicable).