Can I submit a patch to the code?

That's fine. Thanks. Please update the README to describe the new option:

https://bazaar.launchpad.net/~kitterman/postfix-policyd-spf-perl/trunk/view/head:/README

Here is an additional patch you can add with README changes. I didn't update copyright information, but feel free to put my name in if the patch is worthy enough.

Thanks,
Scott

[savarese@mail ~]$ diff -u README*
--- README 2018-07-19 17:35:54.258511843 -0400
+++ README.new 2018-07-19 17:43:03.280587531 -0400
@@ -36,6 +36,12 @@
 list. For these addresses, 'X-Comment: SPF skipped for whitelisted relay' is prepended and logged. IPv6 localhost is also skipped.

+A configuration file, /etc/postfix/exempt_spf_domains, can be used to
+ignore domains that have broken SPF configurations that would normally
+fail. For those domains, add the domain to the file (one per line), and
+restart postfix so that the policy server can reload its configuration.
+The policy server will ignore the domain going forward.
+
 Error conditions within the policy server (that don't result in a crash) or from Mail::SPF will return DUNNO.

Thanks. I've pushed your changes into git for the next release:

https://code.launchpad.net/~kitterman/postfix-policyd-spf-perl/+git/postfix-policyd-spf-perl/+ref/master

I also attempted (unsuccessfully to adapt your solution to the existing relay address handler (historically one just had to edit the code, but that's not a very satisfactory solution). Do you think you might be able to take a look at it and see if you can figure out what's missing?

I don't see an issue just by looking at it, but I'll try running. What issues are you seeing? The idea is that you want to whitelist mail servers on a per IP basis, right?

OK... Here's what I see...

In the grep line where you check if the client address is in relay_addresses, I get an error that relay_addresses doesn't have a $ in front of it to identify it as a variable. That definitely will cause a failure.

It looks like there is also a problem adding addresses to your list. NetAddr::IP doesn't store a list of IPs. It stores just one. So, the map line was wrong...

When reading in the list of relays, you store them as a hash. The idea of using the hash is to make checking if the thing exists quickly. Instead of using a for loop or grep to loop through all values, in one quick line you can check if an element exists. Which is why all the values are "1"; we just don't care about the values, just if a key exists. But since you are using grep to loop through the list of relays anyway, you don't need the hash. By using contains in your lookup, you are not just thinking about one IP... You're thinking about whitelisting entire netblocks. Not a bad idea, but it negates the purpose of the hash... So turn the relay list into an array. I think the grep will work right there.

So, I made the following changes... Let me know if they work for you...

In exempt_relay, the grep line becomes this:
           if grep($_->contains($client_address), @$relay_addresses);
The get_exempt_address function looks like this:

sub get_exempt_address {
   my ( $file ) = @_;

    my $list = [];

    # Return nothing if file not found
    if ( ! -r $file ) {
        return $list;
    }

    # Read the file into one variable, split on space or comma (or all)
    open ( FILE, $file ) or die "Can't open $file: $!\n";
    my $text = "";
    while ( my $tmp = <FILE> ) {
        $text .= $tmp;
    }
    close( FILE );

    foreach my $addr ( split( /[\s,]+/, $text ) ) {
        push( @$list, NetAddr::IP->new($addr) );
    }
    return $list;
}

I hope that helps,
Scott

I've done the release now.

Thanks Scott Kitterman, that solved my question.