Skip to main content
romanr
romanr
New Member
February 15, 2009
Question

SPF Checking

  • February 15, 2009
  • 1 reply
  • 3568 views
Hi, I activated sender-policy-framework some time ago on some fortimails! After having a look through the logs I can see, that SPF checking is being performed, but actually mails are not getting blocked as they should! Log messages say: SPF indicates that MTA (xxxxxx) is not permitted to send email for xxxx.xx ..... but email is still getting through if there is not any other spam-filter hitting it.... The Docs say " An unauthorized client IP address increases the client sender reputation score. An authorized client IP address decreases the client sender reputation score." .... But what if I want to block mails, whose SPF records doesn' t match the originating IP?!?!?!? cheers.roman

    1 reply

    npassion
    npassion
    New Member
    February 17, 2009
    Using SPF itself to make spam/ham decision would cause many false positives. SPF result coupled with deep header analysis (AntisSpam profile > Deep header analysis > Header analysis) would block some SPF violated emails.
    ORIGINAL: romanr Hi, I activated sender-policy-framework some time ago on some fortimails! After having a look through the logs I can see, that SPF checking is being performed, but actually mails are not getting blocked as they should! Log messages say: SPF indicates that MTA (xxxxxx) is not permitted to send email for xxxx.xx ..... but email is still getting through if there is not any other spam-filter hitting it.... The Docs say " An unauthorized client IP address increases the client sender reputation score. An authorized client IP address decreases the client sender reputation score." .... But what if I want to block mails, whose SPF records doesn' t match the originating IP?!?!?!? cheers.roman
    romanr
    romanrAuthor
    New Member
    February 17, 2009
    ORIGINAL: npassion Using SPF itself to make spam/ham decision would cause many false positives.
    Why? If there is a SPF record for a domain, I would like to reject any mail, from servers, that aren' t listed there!
    SPF result coupled with deep header analysis (AntisSpam profile > Deep header analysis > Header analysis) would block some SPF violated emails.
    In my opinion the deep-header analysis brings up alot false positives... I just use it to quarantine in certain situations... cheers.roman
    npassion
    npassion
    New Member
    February 17, 2009
    There are many poorly configured mail servers with valid SPF records that would fail SPF check. One case of such poorly configured mail servers could be: An ISP has a mail server that allows end user to set his/her reply address as his/her account on another mail serser, says xxx@gmail.com. However, this mail server would use xxx@gmail.com as envelope from to send outbound email. This sending behavior would fail SPF check.
    Terms & ConditionsAccessibility statement