This plugin checks a message against Sender Policy Framework (SPF) records published by the domain owners in DNS to fight email address forgery and make it easier to identify spams.
Warden enables the Mail::SpamAssassin::Plugin::SPF plugin in SpamAssassin. For each message it looks up the SPF record of the sender's domain in DNS and tests the envelope sender against it (the SPF_PASS, SPF_NEUTRAL, SPF_FAIL and SPF_SOFTFAIL rules), and, optionally, the HELO hostname used by the connecting server (the SPF_HELO_* rules).
To save DNS lookups, the plugin reuses the SPF results found in Received-SPF headers added by internal (trusted) relays instead of performing the check itself, unless ignore_received_spf_header is set. Which relays are trusted and internal is governed by the trusted_networks and internal_networks configuration; in Warden those are configured in Network Settings.
When a rule lists four scores: the first applies when neither the Bayesian classifier nor network tests are in use, the second when only network tests are in use, the third when only the Bayesian classifier is in use and the fourth when both are in use.
| Area | Rule name | Description | Default scores |
|---|---|---|---|
| header | SPF_PASS |
SPF: sender matches SPF record | -0.001 |
| header | SPF_NEUTRAL |
SPF: sender does not match SPF record (neutral) | 0 0.652 0 0.779 |
| header | SPF_FAIL |
SPF: sender does not match SPF record (fail) | 0 0.919 0 0.001 |
| header | SPF_SOFTFAIL |
SPF: sender does not match SPF record (softfail) | 0 0.972 0 0.665 |
| header | SPF_HELO_PASS |
SPF: HELO matches SPF record | -0.001 |
| header | SPF_HELO_NEUTRAL |
SPF: HELO does not match SPF record (neutral) | 0 0.001 0 0.112 |
| header | SPF_HELO_FAIL |
SPF: HELO does not match SPF record (fail) | 0 0.001 0 0.001 |
| header | SPF_HELO_SOFTFAIL |
SPF: HELO does not match SPF record (softfail) | 0 0.896 0 0.732 |