mirror of
https://github.com/docker-mailserver/docker-mailserver.git
synced 2024-01-19 02:48:50 +00:00
021e942c4c
Consistency pass, formatting cleanup and fixes, introduce admonitions, add front-matter. --- docs: Add front-matter --- docs: Fix and format links - Some links were invalid (eg files moved or renamed) - Some were valid but had invalid section headers (content removed or migrated) - Some use `http://` instead of `https://` when the website supports a secure connection. - Some already used the `[name][reference]` convention but often with a number that wasn't as useful for maintenance. - All referenced docs needed URLs replaced. Opted for the `[name][reference]` approach to group them all clearly at the bottom of the doc, especially with the relative URLs and in some cases many duplicate entries. - All `tomav` references from the original repo prior to switch to an organization have been corrected. - Minor cosmetic changes to the `name` part of the URL, such as for referencing issues to be consistent. - Some small changes to text body, usually due to duplicate URL reference that was unnecessary (open relay, youtous) - Switched other links to use the `[name][reference]` format when there was a large group of URLs such as wikipedia or kubernetes. Github repos that reference projects related to `docker-mailserver` also got placed here so they're noticed better by maintainers. This also helped quite a bit with `mermaid` external links that are very long. - There was a Github Wiki supported syntax in use `[[name | link]]` for `fetchmail` page that isn't compatible by default with MkDocs (needs a plugin), converted to `[name][reference]` instead since it's a relative link. --- docs: Update commit link for LDAP override script Logic moved to another file, keeping the permalink commit reference so it's unaffected by any changes in the file referenced in future. --- docs: Heading corrections Consistency pass. Helps with the Table of Contents (top-right UI) aka Document Outline. docs: codefence cleanup --- docs: misc cleanup --- docs: Add Admonitions Switches `<details>` usage for collapsible admonitions (`???`) while other text content is switched to the visually more distinct admoniton (`!!!` or `???+`) style. This does affect editor syntax highlighting a bit and markdown linting as it's custom non-standard markdown syntax.
57 lines
2.4 KiB
Markdown
57 lines
2.4 KiB
Markdown
---
|
|
title: 'Best Practices | SPF'
|
|
hide:
|
|
- toc # Hide Table of Contents for this page
|
|
---
|
|
|
|
From [Wikipedia](https://en.wikipedia.org/wiki/Sender_Policy_Framework):
|
|
|
|
> Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain's administrators. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records for that domain in the form of a specially formatted TXT record. Email spam and phishing often use forged "from" addresses, so publishing and checking SPF records can be considered anti-spam techniques.
|
|
|
|
For a more technical review: https://github.com/internetstandards/toolbox-wiki/blob/master/SPF-how-to.md
|
|
|
|
## Add a SPF Record
|
|
|
|
To add a SPF record in your DNS, insert the following line in your DNS zone:
|
|
|
|
```txt
|
|
; MX record must be declared for SPF to work
|
|
domain.com. IN MX 1 mail.domain.com.
|
|
|
|
; SPF record
|
|
domain.com. IN TXT "v=spf1 mx ~all"
|
|
```
|
|
|
|
This enables the _Softfail_ mode for SPF. You could first add this SPF record with a very low TTL.
|
|
_SoftFail_ is a good setting for getting started and testing, as it lets all email through, with spams tagged as such in the mailbox.
|
|
|
|
After verification, you _might_ want to change your SPF record to `v=spf1 mx -all` so as to enforce the _HardFail_ policy. See http://www.open-spf.org/SPF_Record_Syntax for more details about SPF policies.
|
|
|
|
In any case, increment the SPF record's TTL to its final value.
|
|
|
|
## Backup MX, Secondary MX
|
|
|
|
For whitelisting a IP Address from the SPF test, you can create a config file (see [`policyd-spf.conf`](https://www.linuxcertif.com/man/5/policyd-spf.conf)) and mount that file into `/etc/postfix-policyd-spf-python/policyd-spf.conf`.
|
|
|
|
**Example:**
|
|
|
|
Create and edit a `policyd-spf.conf` file here `/<your docker-mailserver dir>/config/postfix-policyd-spf.conf`:
|
|
|
|
```conf
|
|
debugLevel = 1
|
|
#0(only errors)-4(complete data received)
|
|
|
|
skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1
|
|
|
|
# Preferably use IP-Addresses for whitelist lookups:
|
|
Whitelist = 192.168.0.0/31,192.168.1.0/30
|
|
# Domain_Whitelist = mx1.mybackupmx.com,mx2.mybackupmx.com
|
|
```
|
|
|
|
Then add this line to `docker-compose.yml`:
|
|
|
|
```yaml
|
|
volumes:
|
|
- ./config/postfix-policyd-spf.conf:/etc/postfix-policyd-spf-python/policyd-spf.conf
|
|
```
|