scott at kitterman
Jul 23, 2008, 10:02 AM
Post #3 of 6
(586 views)
Permalink
|
|
Re: TempError problem with misconfigured SPF record with postfix/smtpd-policy.pl 2.006
[In reply to]
|
|
On Wednesday 23 July 2008 10:58:01 Eddy Beliveau wrote:
> Hi!
>
> I'm using postfix/smtpd-policy.pl 2.006
> and I have problem receiving email from domain which are using DNS's SPF
> record
>
> Jul 21 04:05:50 smtpext4 postfix/policy-spf[20420]: : SPF TempError
> ('SERVFAIL' error on DNS 'SPF' lookup of 'mail.cga-quebec.org'):
> HELO/EHLO: mail.cga-quebec.org
> Jul 21 04:05:50 smtpext4 postfix/policy-spf[1238]: : Policy
> action=DEFER_IF_PERMIT SPF-Result=mail.cga-quebec.org: 'SERVFAIL' error
> on DNS 'SPF' lookup of 'mail.cga-quebec.org'
> Jul 21 04:05:50 smtpext4 postfix/smtpd[1236]: NOQUEUE: reject: RCPT from
> mail.cga-quebec.org[69.70.72.86]: 450 4.7.1 <sender1[at]cga-quebec.org>:
> Sender address rejected: SPF-Result=mail.cga-quebec.org: 'SERVFAIL'
> error on DNS 'SPF' lookup of 'mail.cga-quebec.org';
> from=<sender1[at]cga-quebec.org> to=<recipient1[at]hec.ca> proto=ESMTP
> helo=<mail.cga-quebec.org>
>
> # dig +short SPF cga-quebec.org
> 209.172.51.216
>
> # dig +short TXT cga-quebec.org
> "v=spf1 a mx ip4:216.252.70.146 ip4:69.70.72.86 -all"
>
> I noticed incoherences between SPF and TXT records
>
> If I understand correctly, SPF record has priority above TXT record.
>
> Why does it said "'SERVFAIL' error on DNS 'SPF' lookup" ?
> Why does it return an "TempError" ?
The DNS record type "SPF" is relatively new and some DNS servers do not react
well to type "SPF" queries. I've seen this before, but it is rare. From an
SPF design perspective TempError is the correct SPF result when the domain's
DNS server says it is broken (in the design, all DNS level errors are
considered temporary, even though some, like this, are not really).
> I have this error with many domains which are using misconfigured SPF
> record.TEMPError :
>
> How can I change the behaviour to evaluate TXT record first !!
The policy server uses the Mail::SPF library. This is a function of that
library and not one I can change at the application level. If you are open
to switching applications, the Python implementation does not defer TempError
by default (and can easily be changed in a config file) and the python-spf
library does not query type SPF by default.
I've mentioned this to the Mail::SPF author.
> Am I the only one with that problem ?
It is rare, but certainly not unheard of.
> Any workaround ?
Switching to the Python implementation is the only one I can offer.
Scott K
-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: https://www.listbox.com/member/archive/1020/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1020/
Powered by Listbox: http://www.listbox.com
|
