How to NOT reject if FAIL is for policy in test mode?

That is a rejection due to the HELO check not passing (unlike Mail From testing, there aren't reasons like transparent forwarding that would likely cause SPF to fail when it is being rolled out, so the default value for HELO is different). Specifically, change HELO_reject = SPF_Not_Pass to HELO_reject = Fail to do what you are asking.

That said, they seem to be using the same HELO argument for a wide variety of machines which is non-standard. If you have any relationship with the sender, you might suggest they fix their SPF record. Changing:

ip4:38.127.167.0/28

to

ip4:38.127.167.0/26

would do it.

> Specifically, change HELO_reject = SPF_Not_Pass to HELO_reject = Fail to do what you are asking.

I understand the difference now.

I'm not sure why a 'default', or any other, would execute any action-trigger if a policy is in 'test'

But given the SPF docs'

        Statement Result Meaning
        +all pass Allow all mail
        -all fail Only allow mail that matches one of the
                              parameters (IPv4, MX, etc) in the record
        ~all softfail Allow mail whether or not it matches the
                              parameters in the record
        ?all neutral No policy statement

It seems to me that for those of us who start with default, that's a dangerous one. IT obviously rejects things that, per the spec, should not be.

Just my $0.02.

> you might suggest they fix their SPF record.

Done, thanks.

The SPF RFCs (4408 and 7208) do not specify what receivers are supposed to do, so from a standards perspective, there is no right or wrong answer. I chose that default about a decade ago because it seemed a low risk way to get rid of additional forgeries. I hear complaints about it approximately once every several years, so I continue to believe that was a reasonable decision.

Of course, people have different opinions, so it is configurable. If you have any suggestions for the included documentation that would have made it easier to resolve this on your own, I would appreciate it.

> Of course, people have different opinions, so it is configurable. If you have any suggestions for the included documentation that would have made it easier to resolve this on your own, I would appreciate it.

A blunt, clarifying statement of the functionally-obvious-to-those-that-already-know.

E.g., something to the effect of

'This default was chosen because it seemed a low risk way to get rid of additional forgeries.

You should note that this default will ALSO reject 'softfails'.

That means that senders whose policy is published as being in test mode (~all) will have their email rejected by you, even though they've explicitly stated that that should NOT be done.

If, OTOH, you want compliance with the senders' policy, change

change 'HELO_reject = SPF_Not_Pass' to 'HELO_reject = Fail' in your config.'

Ideally right in the 'policyd-spf.conf.commented' file.

Of course edited to correctness by someone with better detailed understanding of the spec!

-OR-

even though "The SPF RFCs (4408 and 7208) do not specify what receivers are supposed to do", choose instead to use *defaults* that comply with senders' published policies. It should be the user-defined/controlled EXCEPTION to defaults that allows us to " get rid of additional forgeries" at our discretion.

In any case, 'my' problem is solved, so thanks!