<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Folks,<br>
We are attempting to deploy opendmarc(1.1.3) for receiving, with
Postfix (2.9.2), pypolicyd-spf(1.2) and OpenDKIM(2.6.8). We are
getting mixed results, in that while we do see the proper
Authentication-Results headers in our messages, opendmarc seems not
to see the SPF headers. Here is a sample from a recent test
message:<br>
<blockquote>
<pre>Authentication-Results: smtp.onlight.com; spf=pass (sender SPF authorized) smtp.mailfrom=gmail.com (client-ip=209.85.212.68; helo=mail-vb0-f68.google.com; <a class="moz-txt-link-abbreviated" href="mailto:envelope-from=nb1onlight@gmail.com">envelope-from=nb1onlight@gmail.com</a>; <a class="moz-txt-link-abbreviated" href="mailto:receiver=nic@onlight.com">receiver=nic@onlight.com</a>)
Authentication-Results: smtp.onlight.com; dkim=pass
reason="2048-bit key; insecure key"
header.d=gmail.com <a class="moz-txt-link-abbreviated" href="mailto:header.i=@gmail.com">header.i=@gmail.com</a> header.b=gzXzLLLE;
dkim-adsp=pass; dkim-atps=neutral
<...>
Authentication-Results: ujiji.onlight.com/E85322025F; dmarc=pass header.from=gmail.com
</pre>
</blockquote>
However, in the history file we see this:<br>
<blockquote>job E85322025F<br>
reporter smtp.onlight.com<br>
received 1376684253<br>
ipaddr 209.85.212.68<br>
from gmail.com<br>
mfrom gmail.com<br>
dkim gmail.com 0<br>
spf -1<br>
pdomain gmail.com<br>
policy 15<br>
rua <a class="moz-txt-link-freetext"
href="mailto:mailauth-reports@google.com">mailto:mailauth-reports@google.com</a><br>
pct 100<br>
adkim 114<br>
aspf 114<br>
p 110<br>
sp 0<br>
align_dkim 4<br>
align_spf 5<br>
action 2<br>
</blockquote>
We have postfix configured like so:<br>
<blockquote>/etc/postfix/main.cf:<br>
<blockquote>smtpd_recipient_restrictions =
permit_sasl_authenticated,<br>
permit_mynetworks,<br>
reject_unknown_recipient_domain,<br>
reject_unauth_pipelining,<br>
reject_unauth_destination,<br>
check_policy_service unix:private/policyd-spf,<br>
permit_auth_destination,<br>
reject<br>
smtpd_milters = unix:/var/run/opendkim/opendkim.sock<br>
unix:/var/run/opendmarc/opendmarc.sock<br>
</blockquote>
/etc/postfix/master.cf:<br>
<blockquote>policyd-spf unix - n n -
0 spawn<br>
user=nobody argv=/usr/bin/policyd-spf<br>
</blockquote>
</blockquote>
Yet it appears that the Authentication-Results header from
pypolicyd-spf is not in the message when it is processed by
opendmarc. We turned on full debugging in pypolicyd-spf, and added
some debugging to mlfi_eom in an effort to see what's going on, but
while we do see the opendkim headers being processed
(result_method=1,5,7), we do not see the SPF(result_method=4) stuff
at all. It appears we're not even entering the "if
(ar.ares_result[c].result_method == ARES_METHOD_SPF)" section of
mlfi_eom(), even though pypolicyd-spf appears to be prepending the
proper header, and we do see that header in the final email:
<blockquote>Aug 16 15:17:26 ujiji postfix/postscreen[10307]: CONNECT
from [209.85.212.68]:57743 to [10.10.1.25]:25<br>
Aug 16 15:17:32 ujiji postfix/postscreen[10307]: PASS NEW
[209.85.212.68]:57743<br>
Aug 16 15:17:32 ujiji postfix/smtpd[10308]: connect from
mail-vb0-f68.google.com[209.85.212.68]<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"request=smtpd_access_policy"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"protocol_state=RCPT"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"protocol_name=ESMTP"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"client_address=209.85.212.68"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"client_name=mail-vb0-f68.google.com"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"reverse_client_name=mail-vb0-f68.google.com"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"helo_name=mail-vb0-f68.google.com"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line: <a
class="moz-txt-link-rfc2396E"
href="mailto:sender=nb1onlight@gmail.com">"sender=nb1onlight@gmail.com"</a><br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line: <a
class="moz-txt-link-rfc2396E"
href="mailto:recipient=nic@onlight.com">"recipient=nic@onlight.com"</a><br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"recipient_count=0"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line: "queue_id="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"instance=2844.520e88dc.c27e5.0"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line: "size=0"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"etrn_domain="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line: "stress="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"sasl_method="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"sasl_username="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"sasl_sender="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"ccert_subject="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"ccert_issuer="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"ccert_fingerprint="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"ccert_pubkey_fingerprint="<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"encryption_protocol=TLSv1"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"encryption_cipher=RC4-SHA"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line:
"encryption_keysize=128"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Read line: ""<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Found the end of entry<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Config:
{'Mail_From_reject': 'Fail', 'Header_Type': 'AR', 'Whitelist':
'10.10.1.0/24,10.8.0.0/24', 'PermError_reject': 'False',
'HELO_reject': 'SPF_Not_Pass', 'Authserv_Id': 'smtp.onlight.com',
'defaultSeedOnly': 1, 'debugLevel': 9, 'skip_addresses':
'127.0.0.0/8,::ffff:127.0.0.0/104,::1', 'TempError_Defer':
'False'}<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Cached data for this
instance: []<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: spfcheck: pyspf result:
"['None', '', 'helo']"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: None; identity=helo;
client-ip=209.85.212.68; helo=mail-vb0-f68.google.com; <a
class="moz-txt-link-abbreviated"
href="mailto:envelope-from=nb1onlight@gmail.com">envelope-from=nb1onlight@gmail.com</a>;
<a class="moz-txt-link-abbreviated"
href="mailto:receiver=nic@onlight.com">receiver=nic@onlight.com</a><br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: spfcheck: pyspf result:
"['Pass', 'sender SPF authorized', 'mailfrom']"<br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Pass; identity=mailfrom;
client-ip=209.85.212.68; helo=mail-vb0-f68.google.com; <a
class="moz-txt-link-abbreviated"
href="mailto:envelope-from=nb1onlight@gmail.com">envelope-from=nb1onlight@gmail.com</a>;
<a class="moz-txt-link-abbreviated"
href="mailto:receiver=nic@onlight.com">receiver=nic@onlight.com</a><br>
Aug 16 15:17:32 ujiji policyd-spf[10329]: Action: prepend: Text:
Authentication-Results: smtp.onlight.com; spf=pass (sender SPF
authorized) smtp.mailfrom=gmail.com (client-ip=209.85.212.68;
helo=mail-vb0-f68.google.com; <a class="moz-txt-link-abbreviated"
href="mailto:envelope-from=nb1onlight@gmail.com">envelope-from=nb1onlight@gmail.com</a>;
<a class="moz-txt-link-abbreviated"
href="mailto:receiver=nic@onlight.com">receiver=nic@onlight.com</a>)<br>
Aug 16 15:17:32 ujiji postfix/smtpd[10308]: E85322025F:
client=mail-vb0-f68.google.com[209.85.212.68]<br>
Aug 16 15:17:33 ujiji postfix/cleanup[10349]: E85322025F:
message-id=<a class="moz-txt-link-rfc2396E"
href="mailto:CAAUC_Hbtw3iQGDKNDuZ+g71Umh_bFzZDkR0XRyBNWWUp7COqVw@mail.gmail.com"><CAAUC_Hbtw3iQGDKNDuZ+g71Umh_bFzZDkR0XRyBNWWUp7COqVw@mail.gmail.com></a><br>
Aug 16 15:17:33 ujiji opendmarc[9419]: mlfi_eom: entered<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=Authentication-Results<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=Received<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=DKIM-Signature<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=DomainKey-Signature<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=Received<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=Subject<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=From<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=Reply-To<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=To<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=Date<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=Message-ID<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=X-Mailer<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=X-Campaign<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=X-campaignid<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=X-Report-Abuse<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=X-MC-User<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=x-accounttype<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=List-Unsubscribe<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=Sender<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom: hdr_name=x-mcda<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=Content-Type<br>
Aug 16 15:17:33 ujiji opendmarc[8186]: mlfi_eom:
hdr_name=MIME-Version<br>
Aug 16 15:17:33 ujiji opendmarc[9419]: mlfi_eom: c=0
result_method=1 result_result=0<br>
Aug 16 15:17:33 ujiji opendmarc[9419]: mlfi_eom: c=1
result_method=5 result_result=0<br>
Aug 16 15:17:33 ujiji opendmarc[9419]: mlfi_eom: c=2
result_method=7 result_result=3<br>
Aug 16 15:17:33 ujiji opendmarc[9419]: E85322025F: gmail.com pass<br>
Aug 16 15:17:33 ujiji postfix/qmgr[9995]: E85322025F: from=<a
class="moz-txt-link-rfc2396E" href="mailto:nb1onlight@gmail.com"><nb1onlight@gmail.com></a>,
size=1964, nrcpt=1 (queue active)<br>
</blockquote>
Anyone have any thoughts? It seems as though the milters are
getting the message before the policy daemon, and yet the logs would
appear to say otherwise (and they should get it after).<br>
<br>
Any guidance would be greatly appreciated.<br>
<br>
Best regards,<br>
-nic<br>
<pre class="moz-signature" cols="72">--
Nic Bernstein <a class="moz-txt-link-abbreviated" href="mailto:nic@onlight.com">nic@onlight.com</a>
Onlight, Inc. <a class="moz-txt-link-abbreviated" href="http://www.onlight.com">www.onlight.com</a>
219 N. Milwaukee St., Suite 2a v. 414.272.4477
Milwaukee, Wisconsin 53202
</pre>
</body>
</html>