Re: Problem getting python-policyd-spf to reject on Permerror

On 12/14/2017 10:59 AM, Erwin Hoffmann wrote:
> Hi,
>=20

You are referring to outbound mail SPF checks and my question is about=20
inbound SPF actions.

> I am not 100% sure, what you are looking for. But according to your SPF D=
NS setup, something seems strange:
>=20
> ./dnstxt smtp4n.ena.net
> v=3Dspf1 a -all
>=20

My mail filters/relays do not source/originate any emails other than=20
bounces so this is correct.  If you specify "a" in your SPF record, then=20
the email's envelope-from domain is used which is correct.

http://www.openspf.org/SPF_Record_Syntax

> I would expect to see:
>=20
> mx a:smtp4n.ena.net
>=20

I don't need "mx" because this server's outbound email doesn't have an=20
MX record.  I don't receive email for *@smtp4n.ena.net.

As mentioned above, the "a" is fine.

One shouldn't blindly put "mx" in their SPF record if their outbound=20
email doesn't go out the same servers/IPs as their inbound MX flow.  The=20
"mx" should only be used in very simple mail flows and is commonly misused.

> Pease check. A syntactically correct answer would be:
>=20
> /dnstxt fehcom.de
> v=3Dspf1 ip4:85.25.149.179/32 ip6:2001:470:1f0a:58c::2/64 -all
>=20

The official SPF record that we and our customers use is=20
"include:_spf.ena.net" like you would see for this email from ena.com:

"v=3Dspf1 include:_spf.ena.net include:spf.protection.outlook.com -all"

Again, this is all outbound and my question was for an inbound problem.

Thank you anyway.

--=20
David Jones