Invalid SPF emails are not rejected
g00g1 opened this issue · 1 comments
g00g1 commented
Hello. I have observed strange bug (I hope it is not a misconfiguration) - OpenDMARC verifies email and concludes its' SPF and DMARC aren't valid, but for some reason email is still delivered to the mailbox. I appreciate any help with troubleshooting this problem!
Logs belonging to the offending message:
Jul 22 14:43:00 flopster postfix/smtpd[6614]: 5246016E071E: client=p3nlsmtp16.shr.prod.phx3.secureserver.net[72.167.234.241]
Jul 22 14:43:00 flopster postfix/cleanup[6642]: 5246016E071E: message-id=<>
Jul 22 14:43:00 flopster opendmarc[24684]: 5246016E071E: SPF(mailfrom): badspf.com fail
Jul 22 14:43:00 flopster opendmarc[24684]: 5246016E071E: badspf.com fail
Jul 22 14:43:00 flopster postfix/qmgr[28612]: 5246016E071E: from=<test@badspf.com>, size=1616, nrcpt=1 (queue active)
Jul 22 14:43:00 flopster postfix/virtual[6665]: 5246016E071E: to=<XXX@XXX>, orig_to=<XXX@XXX>, relay=virtual, delay=0.88, delays=0.87/0/0/0.01, dsn=2.0.0, status=sent (delivered to maildir)
Jul 22 14:43:00 flopster postfix/qmgr[28612]: 5246016E071E: removed
I have RejectFailures true in the /etc/opendmarc/opendmarc.conf, so this shouldn't be a case.
gurnec commented
That's the choice badspf.com's owner has made.
$ dig _dmarc.badspf.com txt
; <<>> DiG 9.16.1-Ubuntu <<>> _dmarc.badspf.com txt
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40571
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;_dmarc.badspf.com. IN TXT
;; ANSWER SECTION:
_dmarc.badspf.com. 3286 IN TXT "v=DMARC1; p=none; rua=mailto:email@emailspooftest.com; ruf=mailto:email@emailspooftest.com; fo=1:d:s; adkim=r; aspf=s; sp=reject"
The policy p=none instructs mail transfer agents to deliver email which fails DMARC from this domain.