spf is not rejecting emails

[Uki Puki]

I'm facing a lot of issues related to spam. In my own opinion it's because of spf.

Currently I'm using plesk 9.2.1. My spf is setup by plesk panel with fallowing parameters:
- bounce for neutral
- spfguess: spf1 a/24 mx/24 ptr
- all my domains have configured spf entry in dns (and it's proper - checked by external tool)

When I'm trying to send some dummy message from different host I’m getting something like this in my maillog:
May 7 23:13:10 quicksilver spf filter[320]: Starting spf filter...
May 7 23:13:10 quicksilver spf filter[320]: Error code: (2) Could not find a valid SPF record
May 7 23:13:10 quicksilver spf filter[320]: Failed to query guess rules: Could not find a valid SPF record near 'spf1 a/24 mx'
May 7 23:13:10 quicksilver spf filter[320]: SPF result: neutral
May 7 23:13:10 quicksilver spf filter[320]: SPF status: PASS

Email was send from host A.com using [email protected] to my [email protected] (where C.com is one of my domains).
1) B.com has it’s own spf value and it's not matching with A.com so this sould be discarded at first point.
2) Anyway it goes to second step and it's using guess mode to determinate host but it also fails (A.com host is different than B.com host).
3) As you can see in log unfortunately it's passing such emails.

For a time being I thought that it's a meter of this how spf is checking host - I don't know if it's using some system command to determinate this? but also in logs I can see a lot of records like:
May 7 07:06:34 quicksilver relaylock: /var/qmail/bin/relaylock: mail from 84.205.231.248:20889 (host-84-205-231-248.cpe.syzefxis.ote.gr)
What should mean in fact that somehow this spf works for some records.


Can anyone suggest something on this? Frankly speaking I have no idea ;/

 

[BMcKinney]

I can't help with your SPF problem, but I can say this... not very many servers actually use an SPF DNS record, meaning most of the time the SPF result will be "none".

grep " SPF result: " maillog | cut -d: -f5 | sort | uniq -c
1 fail
65 neutral
113 none
51 pass

Almost all of those that resulted in "pass" were from my own server, which does have an SPF record.

Right now, I mostly rely on DNSBL and SpamAssassin with a tweaked spam score and updates from updates.spamassassin.org and sought.rules.yerp.org.

 

[Nataliya Zagr]

Hello,

The following notification occurs in case sending domain domain.tld does not have valid SPF record in DNS. In this case SPF local rules are not applied:

"Could not find a valid SPF record"

The message is processed according to "SPF checking mode" set in server-wide mail preferences {Home -> Mail Server Settings -> Switch on SPF spam protection -> SPF checking mode}.

To resolve the problem you should configure SPF records in DNS zone of domain that sends mail (MAIL FROM).

Please, see the following article for more information:

http://kb.odin.com/en/6051