mirror of
https://github.com/modoboa/modoboa.git
synced 2026-04-25 08:56:02 +03:00
[GH-ISSUE #624] Manage SPF #585
Labels
No labels
bug
bug
dependencies
design
documentation
duplicate
enhancement
enhancement
enhancement
feedback-needed
help-needed
help-needed
installer
invalid
looking-for-sponsors
modoboa-contacts
new-ui
new-ui
pr
pull-request
pyconfr
python
question
security
stale
webmail
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/modoboa-modoboa#585
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @SomeGeek on GitHub (Oct 23, 2014).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/624
Provide the option to manage SPF within Modoboa. SPF is a method to prevent spam by using DNS-checks.
Proposed options:
@hadifarnoud commented on GitHub (May 10, 2016):
or better yet, give user instructions on what DNS records to add. Unfortunately I'm not a developer to be able to help.
@tonioo commented on GitHub (Oct 16, 2016):
@SomeGeek Which component would provide the actions you're talking about ? Because Postfix does not permit that.
@nikaro commented on GitHub (Jan 22, 2017):
@tonioo you can use a SPF policy agent (cf. https://help.ubuntu.com/community/Postfix/SPF).
@tonioo commented on GitHub (Jan 23, 2017):
@nikaro Thank you for the link. Maybe I'm wrong but I think DMARC would be a better answer in this case. What's your opinion?
@nikaro commented on GitHub (Jan 23, 2017):
DMARC checks can be done by OpenDMARC milter, but it seems to come in addition ton SPF and DKIM checks in the configuration i've seen on internet. But i don't know how they interface themselves with each others.
As i understand the things, a DMARC DNS record only enforce the policy to adopt regarding SPF and DKIM (and additionally specify a email address where to send reports).
@tonioo commented on GitHub (Jan 23, 2017):
Absolutely, you indicate other MTA how they should handle unauthenticated (SPF and DKIM) messages coming from your domain. That's a more general setup but I do agree it is not the same "side" of the problem.
Blocking traffic based on a local configuration and only because SPF might be a bit too restrictive from my point of view...
@fpiccinali commented on GitHub (Jan 28, 2017):
What about to provide a tool within the UI to check SPF records is present. (as in MX and DNSBL checks in Domains list)
Maybe check if they are properly configured could be more complicated.
@tonioo commented on GitHub (Feb 1, 2017):
@fpiccinali Yes, that's something I plan to add.
@ValdikSS commented on GitHub (Dec 15, 2020):
Currently, as for 15 Decembler 2020, Modoboa 1.17.0 does not check any of SPF, DKIM, DMARC of the incoming mail.
Letters generated by email spoofing test service https://emailspooftest.com/ all received into inbox.
@tonioo commented on GitHub (Dec 15, 2020):
@ValdikSS It should checked by Amavis... if it's running. Can you check that?
@ValdikSS commented on GitHub (Dec 15, 2020):
@tonioo, the header does contain
X-Virus-Scanned: Debian amavisd-newheader.I've installed Modoboa today, using the installer, on Ubuntu 20.04.1.
@tonioo commented on GitHub (Dec 15, 2020):
@ValdikSS FYI, Modoboa does not deal with DNS record creation/configuration so you must do it yourself.
@ValdikSS commented on GitHub (Dec 15, 2020):
@tonioo, I'm talking about inbound SPF/DKIM/DMARC checks. And yes, I've added the records on my domain.
@tonioo commented on GitHub (Dec 15, 2020):
@ValdikSS Ok, I misunderstood your comment. But my answer is still the same, it should be checked. What is strange in your mail is it does not contain any Authentication-Results header. Amavis should add one... Can you check your logs please?
@tonioo commented on GitHub (Dec 15, 2020):
At least it should check for SPF and DKIM. I don't think DMARC is handled by Amavis so it would require to add a dedicated component, like OpenDMARC. Or maybe replace Amavis/OpenDKIM by rspamd...
@ValdikSS commented on GitHub (Dec 15, 2020):
@tonioo, there's amavis record in the logs of these messages.
Is this an installation issue? Probably configuration change/incompatibility with Ubuntu 20.04.1?
@ValdikSS commented on GitHub (Dec 15, 2020):
Another security issue, slightly related to SPF/DKIM/DMARC checks, is that the mail from the outside with spoofed
Return-Path,FromandToheaders is getting DKIM-signed by Modoboa.I've got the following mail from the outside, without any authentication credentials used by the external server:
@tonioo commented on GitHub (Dec 15, 2020):
@ValdikSS Ok, so the interesting part of your second message is that it is actually checked by Amavis. And maybe that the real issue is the DKIM signature being applied on untrusted sender!
@ValdikSS commented on GitHub (Dec 15, 2020):
Consider adding the following into
/etc/opendkim.confconfiguration:@ValdikSS commented on GitHub (Dec 15, 2020):
No, that's unrelated, it's another check (E4), and the others are bad SPF (E3) and missing DKIM with DMARC policy enforcement (E2).
Please try it yourself on https://emailspooftest.com/
@tonioo commented on GitHub (Dec 15, 2020):
@ValdikSS I'm using rspamd on my local server and results are better. Do you think the configuration you pasted should solve this issue?
@ValdikSS commented on GitHub (Dec 15, 2020):
@tonioo, I'm not an expert in email or email configuration/daemons. I'm testing different email server configurators/installators and checking their features. One of the check is anti-spoofing functionality for incoming mails.
Mail-in-a-box also lacks proper SPF/DKIM/DMARC check, but they use OpenDMARC, which could be properly configured in just two configuration options.
https://github.com/mail-in-a-box/mailinabox/issues/1755#issuecomment-706944871
@tonioo commented on GitHub (Dec 15, 2020):
@ValdikSS Need to check this. Actually it might be a configuration issue with the postfix <> amavis integration. Could you try to modify the /etc/postfix/master.cf ? You just need to add the
no_miltersoption like this:@ValdikSS commented on GitHub (Dec 15, 2020):
@tonioo, that fixed DKIM signature on spoofed email, it's no longer getting signed, but other than that nothing has changed, all 11 emails are still got into inbox.
@tonioo commented on GitHub (Dec 15, 2020):
@ValdikSS Can you check the X-Spam-Score header in received messages?
@ValdikSS commented on GitHub (Dec 15, 2020):
@tonioo, E4 test has:
Other tests do not contain this header.
@tonioo commented on GitHub (Dec 16, 2020):
@ValdikSS So it means their score is too small to be displayed in the headers... That's strange. Maybe default Spamassassin rules have changed with Ubuntu 20.04?
@bloeys commented on GitHub (May 10, 2021):
Any updates on this? Using the latest version and the same test all emails still go into inbox 😅
Is there any fix currently to improve filtering?
@blu-IT commented on GitHub (Sep 21, 2021):
I tested the service above too. All mails (E1 - E10) go into the inbox BUT the most are marked as SPAM:
E1 is a false positive
E2 - E4 are correctly marked as SPAM
E6, E7, E8 & E10 are correctly marked as SPAM
E5 & E9 are false negative / should be marked as SPAM, but aren't marked.