Re: MUA, MTA and SPF

On Friday, January 06, 2012 12:33:12 PM Murray S. Kucherawy wrote:
> > -----Original Message-----
> > From: Jesus Duarte [mailto:[email protected]]
> > Sent: Friday, January 06, 2012 12:23 PM
> > To: [email protected]
> > Cc: David Hudson; Torrie Hughes; "Marc
> > Hudson"@b-lb-mx-quonix.listbox.com
> > Subject: [spf-discuss] MUA, MTA and SPF
> > 
> > I would think that SPF would key in on the IP of the MTA and not the
> > MUA.
> 
> It uses as one of its inputs the IP address of the SMTP client, which in
> your case is the MUA itself.
> > All of our MTAs are listed in our SPF RR.  My question then, is this an
> > error in SPF checks?  If not, is there some sort of "tweak" we are
> > missing in Postfix for authenticating our users within our IP address
> > space short of adding all of those IPs to our SPF record?  Or do we
> > need to contact all of our customers and tell them they must use SMTP
> > authentication?
> 
> I don't think postfix does SPF natively, but rather via a plugin.  You would
> thus configure the plugin not to do SPF evaluation against your MUAs, or
> list in your domain's SPF record all the IP addresses for your MUAs.  (You
> probably want the former.)

In the early days of SPF (2003/4) there was a patchset to do SPF checking 
internal to Postfix, but it is not recommended.  Any SPF checking done now 
should be using the policy service interface in Postfix (it was initially 
developed specifically to support SPF plug-ins).

If someone could let me know how you've integrated SPF checking into your 
Postfix setup, I can help you figure out how to address this problem.  Postfix 
does not inherently distinguish between inbound and outbound connections, so 
it's a matter of setting up postfix to only check SPF when an SPF check is 
appropriate.

Scott K