SPF check fails, but a message is still received

Created:

2016-11-16 13:24:12 UTC

Modified:

2017-08-08 13:40:16 UTC

0

Was this article helpful?


Have more questions?

Submit a request

SPF check fails, but a message is still received

Applicable to:

  • Plesk 12.5 for Linux
  • Plesk 12.0 for Linux

Symptoms

TXT for the domain SPF is configured properly

v=spf1 +a +mx +a:server4.example.com +a:mail.example.com
+a:mail2.example.com +a:mail8.example.com -all

but fake emails with headers that contain USER_IN_WHITELIST are still received:

DomainKey-Status: good
Return-Path: <scanner@example.com>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
server4.example.com
X-Spam-Level:
X-Spam-Status: No, score=-94.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
DKIM_VALID_AU,HELO_MISC_IP,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_PSBL,RDNS_NONE,
USER_IN_WHITELIST autolearn=no version=3.3.1
X-Original-To: dominios@example.com
Delivered-To: jnavoz@example.com
Received: from [203.0.113.2] (unknown [203.0.113.2])
by server4.codetia.com (Postfix) with ESMTP id 51A3AB405A6
for <dominios@example.com>; Tue, 6 Sep 2016 21:14:32 +0200 (CEST)

SPF check fails for the sender IP address:

# spfquery_static -ip 203.0.113.2 -sender scanner@example.com
-rcpt-to dominios@example.com
*failneutral*
Please see
http://www.openspf.org/Why?id=scanner%40example.com&ip=203.0.113.2&receiver=spfquery

: Reason: default
spfquery: 203.0.113.2 is neither permitted nor denied by domain of
example.com
Received-SPF: neutral (spfquery: 203.0.113.2 is neither permitted nor
denied by domain of example.com) client-ip=203.0.113.2;
envelope-from=scanner@example.com;

There is no any whitelist settings in /etc/mail/spamassassin .

Cause

The new SpamAssassin configuration was not applied.

Resolution

  1. Restart SpamAssassin:

    # service spamassassin restart
  2. Monitor mail log for some time to ensure that whitelisting is not applied anymore:

    # grep USER_IN_WHITELIST /var/log/maillog
Have more questions? Submit a request
Please sign in to leave a comment.