Configuring Sender Policy Framework (SPF) on qmail

Hi Roberto , 

     Just wanted to check , whenever a mail is received from a ipv6 host the spf headers in the received mail dont show any ip details or spf status .  Below is the header 

Received: from mail-pl1-x62e.google.com (2607:f8b0:4864:20::62e)
Received-SPF: unknown (mail.example.com: No IP address in conversation)

While the sending domain does have the above ipv6 block in the spf record. 

/var/qmail/control/spfbehavior is 3

Am i missing something in my config. 

this qmail is not IPv6 compliant and the SPF feature is no exception...

Strange , well I have smtpd / smtpsd and submission all working on both ipv4 and ipv6 interfaces .  As we have a dual stack network with ipv4 and ipv6 both enabled on our clients.  The default prefered is ipv6  and I had been using in this way for the past 2+ years.  I start the smtpd / smtpsd and submission in the following way 

smtpd   ( Note the : before 0 below it tells to listen on both ipv4 and ipv6)

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
/usr/local/bin/tcpserver -v -R -l "$LOCAL" \
-x $TCPRULES_DIR/tcp.smtp.cdb -c "$MAXSMTPD" \
-u "$QMAILDUID" -g "$NOFILESGID" :0 25 \
$QMAILDIR/bin/qmail-smtpd /bin/true 2>&1

smtpsd  ( Note the : before 0 below it tells to listen on both ipv4 and ipv6)

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
/usr/local/bin/sslserver -seV -Rp -l "$LOCAL" \
-Xx $TCPRULES_DIR/tcp.smtp.cdb -c "$MAXSMTPD" \
-u "$QMAILDUID" -g "$NOFILESGID" :0 smtps \
$QMAILDIR/bin/qmail-smtpd ~vpopmail/bin/vchkpw /bin/true 2>&1

And Finally submission  ( Note the : before 0 below it tells to listen on both ipv4 and ipv6) as below

exec /usr/local/bin/softlimit -m "$SOFTLIMIT" \
/usr/local/bin/tcpserver -v -R -l "$LOCAL" \
-x $TCPRULES_DIR/tcp.submission.cdb -c "$MAXSMTPD" \
-u "$QMAILDUID" -g "$NOFILESGID" :0 587 \
$QMAILDIR/bin/qmail-smtpd \
~vpopmail/bin/vchkpw /bin/true 2>&1

When you said earlier that this qmail is not IPv6 compliant and the SPF feature is no exception... did you mean that it wont work with IPv6 at all. 

Also maybe you can add the :0 part in the qmail configuring guide for those who want it on both ipv4 and ipv6. Also as we have dovecot working on both ipv4 and ipv6 as per your guide and the doveconf -n output.

Do let me know your suggesstions as I am not an expert in the subject matter but happenned to figure out the above via a few trial and error methods . 

Cheers

Hi Shailendra,

when I say that my qmail is not ipv6 compliant it exactly means that it doesn't handle ipv6 addresses.

On the other hand, tcpserver and sslserver have been upgraded by Erwin Hoffmann and both of them work well with ipv6. The options that you mentioned are NOT qmail options, but tcpserver and/or sslserver options. But once the comunication is in qmail-smtpd's hands, it cannot handle the ipv6 address. So all features that have to do with the remote IP are lost.

Do you have RBL working with ipv6 there? It would be interesting to know if it manages to work...

I am closing communications for ipv6 here, in order to force remote clients to use ipv4 only

HI Roberto , 

    Thanks a lot for clearing my doubts.  Yes I do have rbl working with ipv6  below are the logs . 

2025-04-20 11:04:13.141847367 qmail-smtpd[654048]: rbl: ip=2a01:111:f403:2414::729 query=2a01:111:f403:2414::729.b.barracudacentral.org result=ignore message=''
2025-04-20 11:04:13.159437376 qmail-smtpd[654048]: rbl: ip=2a01:111:f403:2414::729 query=2a01:111:f403:2414::729.zen.spamhaus.org result=ignore message=''
2025-04-20 11:04:13.399191460 qmail-smtpd[654048]: rbl: ip=2a01:111:f403:2414::729 query=2a01:111:f403:2414::729.psbl.surriel.com result=ignore message=''
2025-04-20 11:04:13.647677775 qmail-smtpd[654048]: rbl: ip=2a01:111:f403:2414::729 query=2a01:111:f403:2414::729.bl.spamcop.net result=ignore message=''

I will dig futher with the archive logs and update you if I find anything interesting with rbl and ipv6.

Regards

good to know. Thank's for letting me know

Well I did dig a bit and first of all sorry for doubting the guide .  While going through the logs and the dmarc reports received from various providers  it was noticed that all the reports contained only the ipv4 ip of the server hinting towards only the ipv4 functionality of the qmail-smtpd .  Though it would be interesting to see qmail to function on ipv6 also in near future . It is such a good piece of software . 

Cheers

Finally , I'm back with SPF
I'm doing some test and I found that the URL in the error message dosen't work !

Any idea ?

host -t a spf.pobox.com
Host spf.pobox.com not found: 3(NXDOMAIN)

I think I've fixed this in June 30 patch. Are you using the latest patch?

Sorrryyyyy !!!
I missed the last 2 patchs !!!
To mucho work !

Sorry !

Hi

After a lot of work, finally I have SPF "working"
The incoming emails are marked by SPF, but setting spfbehavior on 3 ,4,5 or 6, the message is not rejected
The emails has the spf header, but not rejection

Received-SPF: fail (xx4.xxx.net: SPF record at 1.co does not designate xxx.xxx.xxx.xxx as permitted sender)

What i'm mising ?
spfbehavior has 644 qmaild qmail permission

Can I debug spf ?

Txs 
Pablo Murillo

Hi, don't you have messages like this in your log?

2023-08-23 02:58:14.340365586 qlogenvelope: result=rejected code=550 reason=spf detail=fail helo=junma.biz mailfrom=xxxxxx@junma.biz

try to test sending yourself a mail with that domain as sender. It has a a bad spf record which fails also with spfbehaviour=3

Hi
I was working with other stuff and I forget completly SPF
Now I'm back, and now I don't see the headers any more !
Ajajaja
I re-compile but, nothing
I'm completly lost
I will check everything again !

I have spfbehaviour with 644 root.root privileges

I suggest using strace against qmail-smtpd to see what's going on 

openat(AT_FDCWD,"control/spfbehavior",O_RDONLY|O_NONBLOCK,00) = 4 (0x4)

read(4,"3\n",64) = 2 (0x2)

close(4) = 0 (0x0)

openat(AT_FDCWD,"control/spfrules",O_RDONLY|O_NONBLOCK,00) = 4 (0x4)

read(4,"include:spf.trusted-forwarder.or"...,64) = 34 (0x22)

close(4) = 0 (0x0)

openat(AT_FDCWD,"control/spfguess",O_RDONLY|O_NONBLOCK,00) ERR#2 'No such file or directory'

openat(AT_FDCWD,"control/spfexp",O_RDONLY|O_NONBLOCK,00) ERR#2 'No such file or directory'

It seems ok..