hmLoadTopic({
hmKeywords:"Sender Policy Framework,SPF",
hmTitle:"SPF Verification",
hmDescription:"MDaemon supports Sender Policy Framework (SPF) to help verify sending servers and protect against spoofing and phishing, which are two common types of email forgery in which the",
hmPrevLink:"security--smtp_authentication.html",
hmNextLink:"security--domainkeys_identified_mail.html",
hmParentLink:"security_menu.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Sender Authentication",
hmTitlePath:"Security Menu > Security Manager > Sender Authentication > SPF Verification",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">SPF Verification<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/sender-authentication_spf-sender-id.png\"\/><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">MDaemon supports Sender Policy Framework (SPF) to help verify sending servers and protect against spoofing and phishing, which are two common types of email forgery in which the sender of the message attempts to make the message appear to be coming from someone else.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Many domains publish MX records in the Domain Name System (DNS) to identify the locations permitted to receive mail for them, but this doesn\'t identify the locations allowed to <\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-style: italic; color: #010100;\">send<\/span><span class=\"f_BodyText\"> mail for them. SPF is a means whereby domains can also publish sender records to identify those locations authorized to send messages. By performing an SPF lookup on incoming messages, MDaemon can attempt to determine whether or not the sending server is permitted to deliver mail for the purported sending domain, and consequently determine whether or not the sender<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s address may have been forged or &quot;spoofed&quot;.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Use the options on this screen to configure your server\'s SPF settings.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">For more information on SPF, visit:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: auto; margin: 0 6.2500rem 0.8750rem 2.8125rem;\"><span class=\"f_SeeAlsoLinks\" style=\"font-weight: normal;\"><a href=\"http:\/\/www.open-spf.org\" target=\"_blank\" class=\"weblink\">http:\/\/www.open-spf.org<\/a><\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">SPF Verification<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Enable SPF verification<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When this option is enabled, MDaemon will perform a DNS query for SPF record data on each incoming message\'s purported sender, to ensure that the sending server is permitted to send messages on its behalf. The host MDaemon will verify is taken from the <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">MAIL<\/span><span class=\"f_ControlIndent\"> value passed during SMTP processing. SPF verification is enabled by default.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Do not verify messages from authenticated sessions<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default authenticated connections are exempt from SPF queries. Authenticated sessions include those verified via <a href=\"security--smtp_authentication.html\" class=\"topiclink\">SMTP Authentication<\/a>, <a href=\"security--pop_before_smtp.html\" class=\"topiclink\">POP before SMTP<\/a>, or the <a href=\"security--ip_shielding.html\" class=\"topiclink\">IP Shield<\/a>. Disable this option if you do not wish to exempt authenticated sessions from SPF.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Do not verify messages from trusted IPs<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default any message from a <a href=\"security--trusted_ips.html\" class=\"topiclink\">trusted IP address<\/a> is exempt from SPF verification.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Cache verification results<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">By default MDaemon will temporarily cache each domain\'s SPF policy record obtained during the DNS query. Clear the checkbox if you do not wish to cache SPF policies.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Cache<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">This button opens the SPF cache, which lists all currently cached SPF records.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Exempt List<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to open the SPF <\/span><span class=\"f_ControlIndent\">Exception List on which you can designate IP addresses, email addresses, and domains that you wish to exempt from SPF lookups. Email addresses are compared against the SMTP envelope not the message From header. Domains are<\/span><span class=\"f_ControlIndent\"> exempted by placing the word &quot;spf&quot; in front of the domain name. MDaemon will include that domain\'s SPF record in every SPF evaluation using an MDaemon specific &quot;wlinclude:&lt;domain&gt;&quot; tag. In this way you can have your backup MX provider treated as a valid SPF source for all senders.<\/span><\/p>\n\r<p class=\"p_CenteredHLine\" style=\"border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_CenteredHLine\">&nbsp;<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">SPF Message Disposition<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">When verification produces a FAIL result:<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...send 550 error code<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this check box if you want a 550 error code to be sent when the result of the SPF query is &quot;Fail&quot;.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...and then close the connection<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Enable this option if you want the connection to be closed immediately after sending the 550 error code.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...add this to the Spam Filter score<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Specify the amount that you wish to add to the message<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent2\">s Spam Score when it fails to pass SPF verification.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Messages from valid sender from a domain listed on the \'Approved List\'<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...add this to the Spam Filter score<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Specify the amount that you wish to add to a message<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_ControlIndent2\">s Spam Score when SPF confirms that it originated from a domain found on the <a href=\"security--approved_list.html\" class=\"topiclink\">Approved List<\/a>.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">Ordinarily the value specified here should be a negative number so that the spam score will be reduced for the approved messages.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_CenteredHLine\" style=\"border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_CenteredHLine\">&nbsp;<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">SPF Settings<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Apply SPF processing to HELO\/EHLO value<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">The option applies SPF verification to the value passed in the HELO or EHLO command at the beginning of the SMTP process. It is enabled by default.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Insert \'Received-SPF\' header into messages<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this option if you want a &quot;Received-SPF&quot; header to be inserted into each message.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...except when the SPF result is \'NONE\'<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Enable this option if you do not wish the &quot;Received-SPF&quot; header to be inserted into a message when the result of the SPF query is &quot;none&quot;.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Use local address in SMTP envelope when forwarding messages<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you want all mail forwarded by MDaemon to use a local address in the SMTP envelope. This helps reduce problems associated with forwarding. Normally, forwarded messages are sent using the email address of the original sender and not the email address that is actually doing the forwarding. In some situations, using a local address may be necessary in order to prevent the receiving server from falsely identifying the forwarded message as having a &quot;spoofed&quot; address. <\/span><span class=\"f_ControlIndent\">This option is enabled by default.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Maximum number of \'Void\' lookups (must be at least 2)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">This is the maximum number of void lookup results permitted in an SPF query before MDaemon generates a permanent error. A Void lookup is one that results in &quot;domain does not exist&quot; or &quot;no answers exist.&quot; This value must be a least &quot;2&quot;.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r"
})
