diff --git a/content/8.plugins/dns-list.md b/content/8.plugins/dns-list.md index f09b5b57..038fd101 100644 --- a/content/8.plugins/dns-list.md +++ b/content/8.plugins/dns-list.md @@ -110,9 +110,5 @@ ok_helo=false ok_mail=false ``` -if DNSBL returns OK on the mail hook, it prevents any subsequent mail hooks in other plugins from running. This might include [SPF](haraka-plugin-spf), [known senders](https://github.com/haraka/haraka-plugin-known-senders), [karma](https://github.com/haraka/haraka-plugin-karma), recipient plugins, and any other plugins that want to do transaction initialization on `hook_mail`. It can be dangerous. +if DNSBL returns OK on the mail hook, it prevents any subsequent mail hooks in other plugins from running. This might include [SPF](https://github.com/haraka/haraka-plugin-spf), [known senders](https://github.com/haraka/haraka-plugin-known-senders), [karma](https://github.com/haraka/haraka-plugin-karma), recipient plugins, and any other plugins that want to do transaction initialization on `hook_mail`. It can be dangerous. -[ci-img]: https://github.com/haraka/haraka-plugin-dns-list/actions/workflows/ci.yml/badge.svg -[ci-url]: https://github.com/haraka/haraka-plugin-dns-list/actions/workflows/ci.yml -[clim-img]: https://codeclimate.com/github/haraka/haraka-plugin-dns-list/badges/gpa.svg -[clim-url]: https://codeclimate.com/github/haraka/haraka-plugin-dns-list diff --git a/content/8.plugins/spf.md b/content/8.plugins/spf.md index 43cd4d4c..459947b8 100644 --- a/content/8.plugins/spf.md +++ b/content/8.plugins/spf.md @@ -4,7 +4,7 @@ description: Haraka spf plugin that implements SPF checks navigation.title: spf --- -# SPF plugin +# haraka-plugin-spf This plugin implements RFC 4408 Sender Policy Framework (SPF) See the [Wikipedia article on SPF](http://en.wikipedia.org/wiki/Sender_Policy_Framework) for details. @@ -15,14 +15,17 @@ To make it reject mail then you will need to enable the relevant options below. of SPF but you will need to whitelist any hosts forwarding mail from another domain whilst preserving the original return-path. -Configuration -------------- +## Configuration + +--- This plugin uses spf.ini for configuration and the following options are available: - [relay] - context=sender (default: sender) +```ini +[relay] +context=sender (default: sender) +``` On connections with relaying privileges (MSA or mail relay), it is often desirable to evaluate SPF from the context of Haraka's public IP(s), in the @@ -62,76 +65,92 @@ openspf_text = true ### Things to Know -* Most senders do not publish SPF records for their mail server *hostname*, +- Most senders do not publish SPF records for their mail server _hostname_, which means that the SPF HELO test rarely passes. During observation in 2014, more spam senders have valid SPF HELO than ham senders. If you expect very little from SPF HELO validation, you might still be disappointed. -* Enabling error deferrals will cause excessive delays and perhaps bounced +- Enabling error deferrals will cause excessive delays and perhaps bounced mail for senders with broken DNS. Enable this only if you are willing to delay and sometimes lose valid mail. -* Broken SPF records by valid senders are common. Keep that in mind when +- Broken SPF records by valid senders are common. Keep that in mind when considering denial of SPF error results. If you deny on error, budget time for instructing senders on how to correct their SPF records so they can email you. -* The only deny option most sites should consider is `mfrom_fail`. That will +- The only deny option most sites should consider is `mfrom_fail`. That will reject messages that explicitely fail SPF tests. SPF failures have a high correlation with spam. However, up to 10% of ham transits forwarders and/or email lists which frequently break SPF. SPF results are best used as inputs - to other plugins such as DMARC, [spamassassin](/plugins/spamassassin), and [karma](/plugins/karma). + to other plugins such as DMARC, [spamassassin](http://haraka.github.io/manual/plugins/spamassassin.html), and [karma](http://haraka.github.io/manual/plugins/karma.html). + +- Heed well the implications of SPF, as described in [RFC 4408](http://tools.ietf.org/html/rfc4408#section-9.3) -* Heed well the implications of SPF, as described in [RFC 4408](http://tools.ietf.org/html/rfc4408#section-9.3) +### spf.ini default settings ```ini +lookup_timeout = 29 + + +[relay] +context=sender + + +[skip] +relaying=false +auth=false + + [defer] -helo_temperror -mfrom_temperror +helo_temperror=false +mfrom_temperror=false + [deny] -helo_none -helo_softfail -helo_fail -helo_permerror +helo_none=false +helo_softfail=false +helo_fail=false +helo_permerror=false -mfrom_none -mfrom_softfail -mfrom_fail -mfrom_permerror +mfrom_none=false +mfrom_softfail=false +mfrom_fail=false +mfrom_permerror=false + +openspf_text=false -openspf_text ; SPF settings used when connection.relaying=true [defer_relay] -helo_temperror -mfrom_temperror +helo_temperror=false +mfrom_temperror=false + [deny_relay] -helo_none -helo_softfail -helo_fail -helo_permerror +helo_none=false +helo_softfail=false +helo_fail=false +helo_permerror=false -mfrom_none -mfrom_softfail -mfrom_fail -mfrom_permerror +mfrom_none=false +mfrom_softfail=false +mfrom_fail=false +mfrom_permerror=false -openspf_text +openspf_text=false ``` -Testing -------- +## Testing This plugin also provides a command-line test tool that can be used to debug SPF issues or to check results. To check the SPF record for a domain: -````sh +```sh # spf --ip 1.2.3.4 --domain fsl.com ip=1.2.3.4 helo="" domain="fsl.com" result=Fail -```` +``` To check the SPF record for a HELO/EHLO name: @@ -145,8 +164,5 @@ You can add `--debug` to the option arguments to see a full trace of the SPF pro ### SPF Resource Record Type Node does not support the SPF DNS Resource Record type. Only TXT records are -checked. +checked. This is a non-issue as < 1% (as of 2014) of SPF records use the SPF RR type. Due to lack of adoption, SPF has deprecated the SPF RR type. -This is a non-issue as < 1% (as of 2014) of SPF records use the SPF RR type. -Due to lack of adoption, the next SPF revision will like likely deprecate the -SPF RR type. \ No newline at end of file diff --git a/nuxt.config.ts b/nuxt.config.ts index f3b3c378..b611c4eb 100644 --- a/nuxt.config.ts +++ b/nuxt.config.ts @@ -1,22 +1,25 @@ export default defineNuxtConfig({ - extends: '@nuxt-themes/docus', - nitro: { - prerender: { - routes: [ - '/barelf', - '/plugins/asn', - '/plugins/fcrdns', - '/plugins/geoip', - '/plugins/p0f', - '/plugins/headers', - '/plugins/data.signatures', - '/plugins/uribl', - '/plugins/helo.checks', - '/plugins/elasticsearch', - '/plugins/syslog', - '/plugins/rcpt_to.ldap', - '/plugins/rcpt_to.routes', - ], - }, - }, + extends: '@nuxt-themes/docus', + + nitro: { + prerender: { + routes: [ + '/barelf', + '/plugins/asn', + '/plugins/data.signatures', + '/plugins/elasticsearch', + '/plugins/fcrdns', + '/plugins/geoip', + '/plugins/headers', + '/plugins/helo.checks', + '/plugins/p0f', + '/plugins/rcpt_to.ldap', + '/plugins/rcpt_to.routes', + '/plugins/syslog', + '/plugins/uribl', + ], + }, + }, + + compatibilityDate: '2025-01-07', })