maddy

 1# SPF
 2
 3check.spf the check module that verifies whether IP address of the client is
 4authorized to send messages for domain in MAIL FROM address.
 5
 6SPF statuses are mapped to maddy check actions in a way
 7specified by \*_action directives. By default, SPF failure 
 8results in the message being quarantined and errors (both permanent and 
 9temporary) cause message to be rejected.
10Authentication-Results field is generated irregardless of status.
11
12## DMARC override
13
14It is recommended by the DMARC standard to don't fail delivery based solely on
15SPF policy and always check DMARC policy and take action based on it.
16
17If `enforce_early` is `no`, check.spf module will not take any action on SPF
18policy failure if sender domain does have a DMARC record with 'quarantine' or
19'reject' policy. Instead it will rely on DMARC support to take necesary
20actions using SPF results as an input.
21
22Disabling `enforce_early` without enabling DMARC support will make SPF policies
23no-op and is considered insecure.
24
25## Configuration directives
26
27```
28check.spf {
29    debug no
30    enforce_early no
31    fail_action quarantine
32    softfail_action ignore
33    permerr_action reject
34    temperr_action reject
35}
36```
37
38### debug _boolean_
39Default: global directive value
40
41Enable verbose logging for check.spf.
42
43---
44
45### enforce_early _boolean_
46Default: `no`
47
48Make policy decision on MAIL FROM stage (before the message body is received).
49This makes it impossible to apply DMARC override (see above).
50
51---
52
53### none_action `reject` | `quarantine` | `ignore`
54Default: `ignore`
55
56Action to take when SPF policy evaluates to a 'none' result.
57
58See [https://tools.ietf.org/html/rfc7208#section-2.6](https://tools.ietf.org/html/rfc7208#section-2.6) for meaning of
59SPF results.
60
61---
62
63### neutral_action `reject` | `quarantine` | `ignore`
64Default: `ignore`
65
66Action to take when SPF policy evaluates to a 'neutral' result.
67
68See [https://tools.ietf.org/html/rfc7208#section-2.6](https://tools.ietf.org/html/rfc7208#section-2.6) for meaning of
69SPF results.
70
71---
72
73### fail_action `reject` | `quarantine` | `ignore`
74Default: `quarantine`
75
76Action to take when SPF policy evaluates to a 'fail' result.
77
78---
79
80### softfail_action `reject` | `quarantine` | `ignore`
81Default: `ignore`
82
83Action to take when SPF policy evaluates to a 'softfail' result.
84
85---
86
87### permerr_action `reject` | `quarantine` | `ignore`
88Default: `reject`
89
90Action to take when SPF policy evaluates to a 'permerror' result.
91
92---
93
94### temperr_action `reject` | `quarantine` | `ignore`
95Default: `reject`
96
97Action to take when SPF policy evaluates to a 'temperror' result.