Skip to content

Commit

Permalink
doc: fix partially qualified URL
Browse files Browse the repository at this point in the history
  • Loading branch information
msimerson committed Jan 8, 2025
1 parent 5448b57 commit 4c5f50f
Show file tree
Hide file tree
Showing 3 changed files with 81 additions and 66 deletions.
6 changes: 1 addition & 5 deletions content/8.plugins/dns-list.md
Original file line number Diff line number Diff line change
Expand Up @@ -110,9 +110,5 @@ ok_helo=false
ok_mail=false
```

if DNSBL returns OK on the mail hook, it prevents any subsequent mail hooks in other plugins from running. This might include [SPF](haraka-plugin-spf), [known senders](https://github.com/haraka/haraka-plugin-known-senders), [karma](https://github.com/haraka/haraka-plugin-karma), recipient plugins, and any other plugins that want to do transaction initialization on `hook_mail`. It can be dangerous.
if DNSBL returns OK on the mail hook, it prevents any subsequent mail hooks in other plugins from running. This might include [SPF](https://github.com/haraka/haraka-plugin-spf), [known senders](https://github.com/haraka/haraka-plugin-known-senders), [karma](https://github.com/haraka/haraka-plugin-karma), recipient plugins, and any other plugins that want to do transaction initialization on `hook_mail`. It can be dangerous.

[ci-img]: https://github.com/haraka/haraka-plugin-dns-list/actions/workflows/ci.yml/badge.svg
[ci-url]: https://github.com/haraka/haraka-plugin-dns-list/actions/workflows/ci.yml
[clim-img]: https://codeclimate.com/github/haraka/haraka-plugin-dns-list/badges/gpa.svg
[clim-url]: https://codeclimate.com/github/haraka/haraka-plugin-dns-list
98 changes: 57 additions & 41 deletions content/8.plugins/spf.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ description: Haraka spf plugin that implements SPF checks
navigation.title: spf
---

# SPF plugin
# haraka-plugin-spf

This plugin implements RFC 4408 Sender Policy Framework (SPF)
See the [Wikipedia article on SPF](http://en.wikipedia.org/wiki/Sender_Policy_Framework) for details.
Expand All @@ -15,14 +15,17 @@ To make it reject mail then you will need to enable the relevant options below.
of SPF but you will need to whitelist any hosts forwarding mail from another
domain whilst preserving the original return-path.

Configuration
-------------
## Configuration

---

This plugin uses spf.ini for configuration and the following options are
available:

[relay]
context=sender (default: sender)
```ini
[relay]
context=sender (default: sender)
```

On connections with relaying privileges (MSA or mail relay), it is often
desirable to evaluate SPF from the context of Haraka's public IP(s), in the
Expand Down Expand Up @@ -62,76 +65,92 @@ openspf_text = true

### Things to Know

* Most senders do not publish SPF records for their mail server *hostname*,
- Most senders do not publish SPF records for their mail server _hostname_,
which means that the SPF HELO test rarely passes. During observation in 2014,
more spam senders have valid SPF HELO than ham senders. If you expect very
little from SPF HELO validation, you might still be disappointed.

* Enabling error deferrals will cause excessive delays and perhaps bounced
- Enabling error deferrals will cause excessive delays and perhaps bounced
mail for senders with broken DNS. Enable this only if you are willing to
delay and sometimes lose valid mail.

* Broken SPF records by valid senders are common. Keep that in mind when
- Broken SPF records by valid senders are common. Keep that in mind when
considering denial of SPF error results. If you deny on error, budget
time for instructing senders on how to correct their SPF records so they
can email you.

* The only deny option most sites should consider is `mfrom_fail`. That will
- The only deny option most sites should consider is `mfrom_fail`. That will
reject messages that explicitely fail SPF tests. SPF failures have a high
correlation with spam. However, up to 10% of ham transits forwarders and/or
email lists which frequently break SPF. SPF results are best used as inputs
to other plugins such as DMARC, [spamassassin](/plugins/spamassassin), and [karma](/plugins/karma).
to other plugins such as DMARC, [spamassassin](http://haraka.github.io/manual/plugins/spamassassin.html), and [karma](http://haraka.github.io/manual/plugins/karma.html).

- Heed well the implications of SPF, as described in [RFC 4408](http://tools.ietf.org/html/rfc4408#section-9.3)

* Heed well the implications of SPF, as described in [RFC 4408](http://tools.ietf.org/html/rfc4408#section-9.3)
### spf.ini default settings

```ini
lookup_timeout = 29


[relay]
context=sender


[skip]
relaying=false
auth=false


[defer]
helo_temperror
mfrom_temperror
helo_temperror=false
mfrom_temperror=false


[deny]
helo_none
helo_softfail
helo_fail
helo_permerror
helo_none=false
helo_softfail=false
helo_fail=false
helo_permerror=false

mfrom_none
mfrom_softfail
mfrom_fail
mfrom_permerror
mfrom_none=false
mfrom_softfail=false
mfrom_fail=false
mfrom_permerror=false

openspf_text=false

openspf_text

; SPF settings used when connection.relaying=true
[defer_relay]
helo_temperror
mfrom_temperror
helo_temperror=false
mfrom_temperror=false


[deny_relay]
helo_none
helo_softfail
helo_fail
helo_permerror
helo_none=false
helo_softfail=false
helo_fail=false
helo_permerror=false

mfrom_none
mfrom_softfail
mfrom_fail
mfrom_permerror
mfrom_none=false
mfrom_softfail=false
mfrom_fail=false
mfrom_permerror=false

openspf_text
openspf_text=false
```

Testing
-------
## Testing

This plugin also provides a command-line test tool that can be used to debug SPF issues or to check results.

To check the SPF record for a domain:

````sh
```sh
# spf --ip 1.2.3.4 --domain fsl.com
ip=1.2.3.4 helo="" domain="fsl.com" result=Fail
````
```

To check the SPF record for a HELO/EHLO name:

Expand All @@ -145,8 +164,5 @@ You can add `--debug` to the option arguments to see a full trace of the SPF pro
### SPF Resource Record Type

Node does not support the SPF DNS Resource Record type. Only TXT records are
checked.
checked. This is a non-issue as < 1% (as of 2014) of SPF records use the SPF RR type. Due to lack of adoption, SPF has deprecated the SPF RR type.

This is a non-issue as < 1% (as of 2014) of SPF records use the SPF RR type.
Due to lack of adoption, the next SPF revision will like likely deprecate the
SPF RR type.
43 changes: 23 additions & 20 deletions nuxt.config.ts
Original file line number Diff line number Diff line change
@@ -1,22 +1,25 @@
export default defineNuxtConfig({
extends: '@nuxt-themes/docus',
nitro: {
prerender: {
routes: [
'/barelf',
'/plugins/asn',
'/plugins/fcrdns',
'/plugins/geoip',
'/plugins/p0f',
'/plugins/headers',
'/plugins/data.signatures',
'/plugins/uribl',
'/plugins/helo.checks',
'/plugins/elasticsearch',
'/plugins/syslog',
'/plugins/rcpt_to.ldap',
'/plugins/rcpt_to.routes',
],
},
},
extends: '@nuxt-themes/docus',

nitro: {
prerender: {
routes: [
'/barelf',
'/plugins/asn',
'/plugins/data.signatures',
'/plugins/elasticsearch',
'/plugins/fcrdns',
'/plugins/geoip',
'/plugins/headers',
'/plugins/helo.checks',
'/plugins/p0f',
'/plugins/rcpt_to.ldap',
'/plugins/rcpt_to.routes',
'/plugins/syslog',
'/plugins/uribl',
],
},
},

compatibilityDate: '2025-01-07',
})

0 comments on commit 4c5f50f

Please sign in to comment.