Re: MUA, MTA and SPF

Hi Jesus,

Jesus Duarte wrote:
> We are a regional ISP in the Pacific Northwest and have hundreds of DSL
> customers.  We run Postfix on our mail servers and we have all of our DSL
> IPs authorized to send mail without having to use MUA authentication.  For
> those with email accounts with us and not on our network the MUA must
> authenticate.  The problem comes with our network users that are not using
> SMTP authentication.  If they do not authenticate, SPF keys in on the IP of
> the MUA and gives an SPF error and consequently several customers have their
> emails bounced.
> 
> I would think that SPF would key in on the IP of the MTA and not the MUA.

The MUA is the MTA :), or rather contains an MTA component to send 
mail. Its just special MTA that comes integrated with Mail 
Pickup/Reader/Writer components.

> All of our MTAs are listed in our SPF RR.  My question then, is this an
> error in SPF checks?  

No.  The SPF policy in place simply doesn't cover a segment of your users.

> If not, is there some sort of "tweak" we are missing
> in Postfix for authenticating our users within our IP address space short of
> adding all of those IPs to our SPF record?  Or do we need to contact all of
> our customers and tell them they must use SMTP authentication?
> 
> OK, that was three questions.  ;-)  I am hoping to get a hit on a "tweak" in
> Postfix.

The issue you see is quite normal for many ISP/ESPs.  In general, the 
only time you need to authenticate (using any method) is to determine 
if the user is allow to relay (send mail outside the network).  In 
other words, if the target mail is for a local user or a locally 
hosted domain, then your SMTP receiver should not require 
authentication. This is how EMAIL grew to where it is today, by 
allowing for unauthenticated transaction for the MDA. It was a 
blessing for its growth, since without this, I sincerely doubt SMTP 
would of taken over as fast as it did. But it was also a curse by 
allowing abusive anonymous unauthenticated local mail transactions.

But the support headache about having to tell users to use SMTP AUTH 
is real.  One long time method widely used is help reduce these 
support headaches is to implement POP B4 SMTP.  Since most MUAs, if 
not all, are automatically prepared to POP in frequently before the 
user sends mail, this allows a method to use IP Authentication which 
you already have. POPB4SMTP, while some consider a kludge, its long 
known to help lower the support cost/needs to inform/tell/teach users 
how to prepare SMTP authentication for their MUA which at best, you 
can only cover only the top brand few.

If you don't know how it works, when the user's MUA pops in, which 
requires user/password authentication, the POP server will send a 
signal and data with the user's machine IP address to the SMTP server 
opening a small sysop-defined time window for IP-based authentication 
for the user's next SMTP session without requiring SMTP AUTH.  The 
time window varies for setups, ours I believe is 10 mins.  It works. :)

--
HLS