Re: private relay ... could i use srs to avoid spf fail?

On Fri, 2006-12-01 at 12:22 +0000, Camart Ltd wrote:
> Aha!  That was my next question - whether it is easy/possible to use SRS 
> for *relay* rather than *forwarding* ... all the documentation I have 
> been able to find has, understandably, only discussed forwarding.

I was talking about forwarding. I assume that by 'relay' you just mean
operating as an MX backup? In that case, the recipients _definitely_
shouldn't be rejecting mail due to SPF failures. Or you mean operating
as an _outgoing_ SMTP smarthost for people? In which case they shouldn't
be publishing SPF records which don't include your server(s).

> Which MTA did you use? Did you need to do anything exotic to make it use 
> SRS for relay?

I use Exim -- it's fairly simple to do stuff like that purely in Exim's
ACL configuration language. http://www.infradead.org/rpr.html has my
original write-up; the one I'm currently using is slightly modified, at 
http://david.woodhou.se/eximconf/include/routers-ses

Note that I do something similar to SRS on all outgoing mail, so that I
don't ever send MAIL FROM:<[email protected]> and hence don't ever
have to accept bounces to such addresses.

> >it only needs to do so in the case where:
> > 1. The sender address has an SPF record.
> >  
> >
> That seems very sensible - absolutely no point monkeying around if SPF 
> isn't used!
> 
> > 2. The recipient is known to check SPF and reject for failure.
> >
> >I have a 'blacklist' of the second type of recipient, but in fact it's
> >empty apart from the test cases, because whenever forwarded mail has
> >been rejected and I've contacted the admin of the offending server
> >they've fixed it by no longer using SPF. So I basically never do SRS on
> >forwarded mail because it never matches condition #2.
> >  
> >
> In this case it really needs to work first time with unknown destination 
> servers.  I'm looking to provide a relay for random guests who are just 
> 'dropping in' to our network.  Some of them are non technical people 
> whose mail client is configured to use their ISP's SMTP server.  They 
> don't understand why they can't send mail from our network, so we are 
> considering rerouting all outgoing SMTP through our own relay..... 
> simple enough, but we don't want to introduce SPF Fail problems for 
> people who would otherwise have sent mail fine through their own SMTP 
> server.

There will _always_ be receiving mailservers out there which reject your
mail for spurious reasons. Some people even reject if your HELO greeting
doesn't contain the same domain name as the one in MAIL FROM!. You can't
be expected to deal with everyone's misconfiguration -- I really would
suggest that you don't bother with it. And perhaps give a _warning_ to
those whose sender address _is_ afflicted with SPF, so that they know
their mail might not get through. There are other situations where their
mail would be rejected even when they send from the 'normal' mailhosts,
anyway.

-- 
dwmw2