Re: Problem getting python-policyd-spf to reject on Permerror

On 12/14/2017 12:47 PM, David Jones via spf-devel wrote:
> On 12/14/2017 12:05 PM, Scott Kitterman wrote:
>> On Thursday, December 14, 2017 04:45:14 PM David Jones via spf-devel=20
>> wrote:
>>> I would like to up my SPF game a bit and provide feedback to those=20
>>> who don't
>>> have a misconfigured SPF record.=C2=A0 I have enabled debugging and onl=
y=20
>>> see an
>>> action of prepending the AR header.
>>>
>>> postfix-3.0.5-1.el6.x86_64
>>> python-pyspf-2.0.11-1.el6.noarch
>>>
>>> /etc/python-policyd-spf/policyd-spf.conf
>>> debugLevel =3D 5
>>> defaultSeedOnly =3D 1
>>> HELO_reject =3D False
>>> Mail_From_reject =3D Fail
>>> No_Mail =3D False
>>> PermError_reject =3D True
>>> TempError_Defer =3D False
>>> skip_addresses =3D 127.0.0.0/8,::ffff:127.0.0.0/104,::1
>>> Whitelist =3D 96.4.1.0/26,96.5.1.0/26
>>> Header_Type =3D AR
>>>
>> ...
>>>
>>> How do I get the action above to reject instead of adding a header?
>>
>> There is a bug (that I haven't root caused yet) related to No_Mail.=C2=
=A0 I=20
>> believe
>> if you remove No_Mail =3D False from your config it will work.=C2=A0 Tha=
t's the
>> default anyway, so it should be fine to remove it.
>>
>> Scott K
>>
>=20
> Thank you.=C2=A0 That did it!=C2=A0 I am rejecting PermErrors now.
>=20

Wow!  There are a lot of SPF problems out there.  I wish there were a=20
way to bounce the emails back to admins and responsible parties but=20
allow the message through at the same time.

There's no good way to get feedback to mail admins unless they setup=20
DMARC reporting and take things seriously.  It's going to take a major=20
push by a very large company or community to make SPF a requirement to=20
send email on the Internet.

I wish valid SPF records were a requirement to send on the Internet much=20
like FCrDNS has become a hurdle to jump.

I may end up having to back this change out and treat SPF PermErrors=20
like SPF Fails with a slight penalty on a spam score.

--=20
David Jones