Postfix
為什麼 postfix 不驗證發件人是他們所說的使用反向 dns、SPF 或 DMARC 的人？
確保 postfix 不是開放中繼，我嘗試從我的郵件地址向我的郵件地址發送郵件，telnet 日誌如下所示：
Resolving hostname... Connecting... SMTP -> FROM SERVER: 220 mail.example.com ESMTP Postfix SMTP -> FROM SERVER: 250-mail.example.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN MAIL FROM: braiam@example.com SMTP -> FROM SERVER: 250 2.1.0 Ok RCPT TO: braiam@example.com SMTP -> FROM SERVER: 250 2.1.5 Ok Sending Mail Message Body... SMTP -> FROM SERVER: 354 End data with . SMTP -> FROM SERVER: 250 2.0.0 Ok: queued as XXXXXXXX Message completed successfully.我的 main.cf 上的非預設值
postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases append_dot_mydomain = no biff = no config_directory = /etc/postfix inet_interfaces = all inet_protocols = all lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3 lmtp_tls_protocols = !SSLv2, !SSLv3 mailbox_size_limit = 0 mydestination = $myhostname, localhost.$mydomain, localhost mydomain = example.com myhostname = mail.$mydomain mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 myorigin = $mydomain non_smtpd_milters = inet:127.0.0.1:8891 policy-spf_time_limit = 3600s readme_directory = no recipient_delimiter = + relayhost = smtp_generic_maps = hash:/etc/postfix/generic smtp_tls_ciphers = medium smtp_tls_exclude_ciphers = EXPORT, LOW, MD5, aDSS, kECDHe, kECDHr, kDHd, kDHr, SEED, IDEA, RC2 smtp_tls_loglevel = 1 smtp_tls_mandatory_protocols = !SSLv2,!SSLv3 smtp_tls_protocols = !SSLv2,!SSLv3 smtp_tls_security_level = may smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_banner = $myhostname ESMTP $mail_name smtpd_client_connection_rate_limit = 5 smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_milters = inet:127.0.0.1:8891 smtpd_recipient_restrictions = reject_invalid_hostname, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unauth_destination, reject_unverified_recipient, permit_mynetworks, check_recipient_access pcre:/etc/postfix/recipient_checks.pcre, check_helo_access hash:/etc/postfix/helo_checks, check_policy_service unix:private/policy-spf, reject_rbl_client cbl.abuseat.org, reject_rbl_client sbl.spamhaus.org, reject_rbl_client pbl.spamhaus.org, check_sender_access hash:/etc/postfix/check_backscatterer permit smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous,noplaintext smtpd_sasl_tls_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sender_login_maps = hash:/etc/postfix/virtual/mailboxes smtpd_tls_auth_only = yes smtpd_tls_cert_file = /etc/letsencrypt/live/example.com/fullchain.pem smtpd_tls_ciphers = medium smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem smtpd_tls_eecdh_grade = strong smtpd_tls_exclude_ciphers = EXPORT, LOW, MD5, SEED, IDEA, RC2 smtpd_tls_key_file = /etc/letsencrypt/live/example.com/privkey.pem smtpd_tls_loglevel = 1 smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3 smtpd_tls_protocols = !SSLv2,!SSLv3 smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA tls_ssl_options = NO_COMPRESSION tlsproxy_tls_mandatory_protocols = $smtpd_tls_mandatory_protocols tlsproxy_tls_protocols = $smtpd_tls_protocols virtual_alias_maps = hash:/etc/postfix/virtual/aliases virtual_mailbox_domains = example.com virtual_mailbox_maps = hash:/etc/postfix/virtual/mailboxes virtual_transport = lmtp:unix:private/dovecot-lmtp檢查郵件標頭我發現 SPF 失敗：
Return-Path: <braiam@example.com> Delivered-To: <braiam@example.com> Received: from mail.example.com by compute.internal (Dovecot) with LMTP id XXXXXXXXXXX for <braiam@example.com>; Fri, 08 Apr 2016 01:56:03 +0000 Received-SPF: Fail (SPF fail - not authorized) identity=mailfrom; client-ip=184.72.226.23; helo=www.wormly.com; envelope-from=braiam@example.com; receiver=braiam@example.com Received: from www.wormly.com (node-mec2.wormly.com [184.72.226.23]) by mail.example.com (Postfix) with ESMTP id 1234567890 for <braiam@example.com>; Fri, 8 Apr 2016 01:56:02 +0000 (UTC) Date: Fri, 08 Apr 2016 01:56:03 +0000 From: braiam@example.com To: braiam@example.com為什麼是這樣？postfix 不應該在使用 smptd_recipient_restrictions 接收電子郵件之前進行檢查嗎？
Postfix 本身既不檢查 SPF、DKIM 也不檢查 DMARC。它依賴於外部服務來做到這一點。在上述配置中，SPF 檢查是由偵聽
private/policy-spf套接字的服務執行的。如果應該在 SPF 失敗時拒絕消息，則必須在相應的策略服務中配置此行為。此策略服務存在 Perl 和 Python 實現，因此細節可能有所不同。用python實現，設置參數
HELO_reject = SPF_Not_Pass Mail_From_reject = failin
/etc/postfix-policyd-spf-python/policyd-spf.conf應該會立即拒絕 SPF 不匹配的郵件。否則，服務將只添加一個標頭並接受該消息。如果身份驗證結果被另一個服務使用，則後一種行為可能很有用（參見Skelleton 的這篇文章，描述如何設置 OpenDMARC milter）。DKIM 身份驗證器（我猜這是上面 conf 中列出的 milter）也必須進行配置。
另外：在您的範例中不是這種情況，但應該注意，如果在 SPF 策略檢查返回之前列出的任何收件人檢查，則不會執行SPF 策略檢查
OK。因此，如果要從本地主機發送郵件，則永遠不會執行 SPF 檢查。