Bumping this once more with additional information and a new example:
Here’s an email where SPF should have failed but it didn’t. Full headers with truncated recipient/faked sender:
Received: from vm3315861.24ssd.had.wf (localhost [127.0.0.1])
by vm3315861.24ssd.had.wf (8.14.7/8.14.7) with ESMTP id 228I1YpU028785
for <$USER@mga.lu>; Tue, 8 Mar 2022 20:01:34 +0200
Received: (from root@localhost)
by vm3315861.24ssd.had.wf (8.14.7/8.14.7/Submit) id 228I1Ysc028765;
Tue, 8 Mar 2022 20:01:34 +0200
Received: from mail.mymx.lu ([172.22.1.253])
by 21ac8f7e1993 with LMTP
id SMCnHQSaJ2LgZQAAlX/YNQ
(envelope-from <root@vm3315861.24ssd.had.wf>)
for <$USER@mga.lu>; Tue, 08 Mar 2022 19:01:40 +0100
Received: from vm3315861.24ssd.had.wf (vm3315861.24ssd.had.wf [80.89.229.175])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mail.mymx.lu (Postcow) with ESMTPS id A8964305628
for <$USER@mga.lu>; Tue, 8 Mar 2022 19:01:39 +0100 (CET)
From: "fax@mga.lu" <$USER@mga.lu>
To: <$USER@mga.lu>
Subject: =?UTF-8?Q?=E2=9C=85_Notification:_You_have_receive?=
=?UTF-8?Q?d_a_new_fax_document_-_4_page=28s=29?=
Date: Tue, 8 Mar 2022 19:01:34 +0100
Message-ID: <202203081801.228I1Ysc028765@vm3315861.24ssd.had.wf>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0076_01D833C1.FEAD8900"
X-Last-TLS-Session-Version: TLSv1.2
X-Rspamd-Queue-Id: A8964305628
Authentication-Results: mail.mymx.lu;
dkim=none;
dmarc=none;
spf=none (mail.mymx.lu: domain of root@vm3315861.24ssd.had.wf has no SPF policy when checking 80.89.229.175) smtp.mailfrom=root@vm3315861.24ssd.had.wf
X-Spamd-Result: default: False [7.33 / 15.00];
BAYES_SPAM(4.50)[99.99%];
NEURAL_HAM_LONG(-4.00)[-1.000];
MX_MISSING(3.50)[];
FORGED_W_BAD_POLICY(3.00)[];
NEURAL_HAM_SHORT(-2.00)[-1.000];
AUTH_NA(1.00)[];
MV_CASE(0.50)[];
MX_INVALID(0.50)[];
MIME_HTML_ONLY(0.20)[];
MIME_BASE64_TEXT(0.10)[];
IP_REPUTATION_SPAM(0.03)[asn: 204601(0.00), country: NL(0.01), ip: 80.89.229.175(0.00)];
TO_MATCH_ENVRCPT_ALL(0.00)[];
PREVIOUSLY_DELIVERED(0.00)[$USER@mga.lu];
MAILCOW_DOMAIN_HEADER_FROM(0.00)[mga.lu];
RCPT_COUNT_ONE(0.00)[1];
DMARC_NA(0.00)[mga.lu];
R_SPF_NA(0.00)[no SPF record];
FROM_HAS_DN(0.00)[];
BCC(0.00)[];
ASN(0.00)[asn:204601, ipnet:80.89.228.0/23, country:NL];
ARC_NA(0.00)[];
RCVD_COUNT_THREE(0.00)[3];
FORGED_SENDER(0.00)[$USER@mga.lu,root@vm3315861.24ssd.had.wf];
ARC_SIGNED(0.00)[mga.lu:s=dkim:i=1];
TO_DN_NONE(0.00)[];
HAS_DATA_URI(0.00)[];
RCPT_MAILCOW_DOMAIN(0.00)[mga.lu];
R_DKIM_NA(0.00)[];
FROM_NEQ_ENVFROM(0.00)[$USER@mga.lu,root@vm3315861.24ssd.had.wf];
RCVD_TLS_LAST(0.00)[];
MIME_TRACE(0.00)[0:~];
TO_EQ_FROM(0.00)[];
GREYLIST(0.00)[pass,body]
Thread-Index: AQEJErZWwdpC62BIOKr5a7IHKqfbBg==
This is a multipart message in MIME format.
The most interesting part here is this one:
Authentication-Results: mail.mymx.lu;
dkim=none;
dmarc=none;
spf=none (mail.mymx.lu: domain of root@vm3315861.24ssd.had.wf has no SPF policy when checking 80.89.229.175) smtp.mailfrom=root@vm3315861.24ssd.had.wf
There is no other mention of SPF. So here, only the originating server/envelope from was checked for SPF, but not the header from server which should IMHO at least also have been checked (If not, SPF is useless).
For mga.lu
, an SPF record exists:
kwisatz@thufir:~$ dig +short TXT mga.lu
"v=spf1 a mx ~all"
Is this a configuration problem on our or mailcow’s side or is it an rspamd bug?