Back to Community Threads
Does smartermail strictly enforce SPF processing limits as defined in RFC 4408?
Idea shared by CCC - 10/30/2014 at 9:28 AM
Under Consideration
SPF implementations MUST limit the number of mechanisms and modifiers that do DNS lookups to at most 10 per SPF check, including any lookups caused by the use of the "include" mechanism or the "redirect" modifier. If this number is exceeded during a check, a PermError MUST be returned.
Does Smartermail enforce this?
 
If so does it log a specific error when SPF fails with a PermError due to excessive SPF recursion (as opposed to just logging an SPF failure)?
 
MTAs or other processors MAY also impose a limit on the maximum amount of elapsed time to evaluate check_host(). Such a limit SHOULD allow at least 20 seconds. If such a limit is exceeded, the result of authorization SHOULD be "TempError".
Does Smartermail impose this limit? 
 
If so, is it configurable?
 

 
Thanks for raising this question, CCC.
Bruce Barnes
ChicagoNetTech Inc
brucecnt@comcast.net

Phonr: (773) 491-9019
Phone: (224) 444-0169

E-Mail and DNS Security Specialist
Network Security Specialist

Customer Service Portal: https://portal.chicagonettech.com
Website: https://www.ChicagoNetTech.com
Security Blog: http://networkbastion.blogspot.com/

Web and E-Mail Hosting, E-Mail Security and Consulting
Employee Replied
11/4/2014 at 11:34 AM
Employee Post
SPF implementations MUST limit the number of mechanisms and modifiers that do DNS lookups to at most 10 per SPF check, including any lookups caused by the use of the "include" mechanism or the "redirect" modifier. If this number is exceeded during a check, a PermError MUST be returned.
 
Does Smartermail enforce this?
 
If so does it log a specific error when SPF fails with a PermError due to excessive SPF recursion (as opposed to just logging an SPF failure)?
 
SmarterMail does enforce the DNS lookup limit.  We currently do not log the specific error but simply the SPF failure.
 
MTAs or other processors MAY also impose a limit on the maximum amount of elapsed time to evaluate check_host(). Such a limit SHOULD allow at least 20 seconds. If such a limit is exceeded, the result of authorization SHOULD be "TempError".
 
Does Smartermail impose this limit? 
 
If so, is it configurable?
 
SmarterMail does not impose a maximum elapsed time limit on the checks.
 
Feature request to log SPF fail due to RFC 4408? I believe I am having problems with outlook.com failing SPF tests intermittently as a result.

More detail in this thread

http://portal.smartertools.com/community/a616/mail-rejected-due-to-smtp-spam-blocking-_spf-fail.aspx
Employee Replied
11/4/2014 at 2:21 PM
Employee Post
I've add this to our feature requests list.
Just checking in to see if this is on the radar for inclusion in a nearby release?
Looking for any updates on this as well. Ran into this today with a domain that is falling into this bucket.
 
https://tools.ietf.org/html/rfc4408#section-4.7
 
SmarterMail is showing a perm error on this spf record:
 
v=spf1 include:_spf-a.domain.com include:_spf-b.domain.com
 
Note the missing "all" at the end. Every spf tool passes this record but SM is setting this to permfail. I'd like to know why it is perm failing.
Any updates on this or "still under consideration"?
This is valid syntax..
Campaign Cleaner - The Ultimate Tool for Optimized, High-Performance Email Campaigns
It appears that a few other people are looking for some logging when SPF lookups fail due to the number of entries.  This appears to still be under consideration. 
 
I'm bumping the thread in hopes that others may chime in so that this may get some traction.  
I will bump this thread as well. Now since we implemented stricter policies on our SM install I am starting to see SPF failure messages in our logs. When I look up the SPF policy via MXToolbox the policy passes for said domain. My only work around for now is to change the scoring in my SPF check to a lower number. I had it set to 30 for Fail and also uncheck the option for Enable for SMTP blocking. That way I can be sure no other legitimate email gets blocked. I have seen a bunch of listings especially in the past 2 weeks since setting up our policies and most of them were indeed garbage domains. I did use Bruce's document as our guideline and appreciate the work Bruce put into the document for all of us. It was a big help in getting things configured properly.
 
Anyways, the log just shows _SPF(Fail) but gives no other reason why. We are running SM Version 14.5.5907 enterprise. Is this addressed in a newer build? Or is this something that is still a work in progress? I see this was brought up 2 years ago but haven't seen an update on this.
Checking this again. Still having this issue where SM thinks there is a spf perm error but it validates using every other tool we try. Can we get some additionally logging options on spf failures to see why they are failing?
Just to add to this again, the SPF perm errors that I saw in our log, I got a custom build from SM that had extra logging. What I found was the domains that failed had several SPF records specified and they were from different providers. So in turn  SM labelled them as perm errors. I did discuss with the dev team that logging like this really should be in SM permanently so as a server administrator we can troubleshoot issues like this. The dev did discuss this with management and it was placed on the feature board but no time frame was placed on this being implemented.
Larry Duran Replied
5/30/2017 at 10:40 AM
Employee Post
Adding spam check logging is something we have scheduled for a future 16 minor release, probably a 16.1 minor.  Initially it will contain logging for SPF checks, since a lot of debug logging we provide is for SPF checks, but it will grow to cover other spam checks when needed.
 
So keep an eye out for our next minor release and check the release notes.
Larry Duran
Product Manager 
SmarterTools Inc.
www.smartertools.com 
Back to Community Threads

Reply to Thread

Enter the verification text
Related Knowledge Base Articles
Google Safe Browsing Warning and SmarterMailSmarterMail > Troubleshooting
Set up Autodiscover for SmarterMailSmarterMail > Installation and Configuration
Messages from Trusted Senders are going to my Junk folderSmarterMail > Troubleshooting
How Does MAPI & EWS and EAS Licensing Work?SmarterMail > Installation and Configuration
Migrating SmarterMail to LinuxSmarterMail > Server Configuration and Management