Mirror/app-MAIL-temp
1
0
Fork 0
mirror of https://github.com/simple-login/app.git synced 2024-09-16 07:01:30 +02:00
Code Issues Packages Projects Releases Wiki Activity
753a28e886
app-MAIL-temp/docs/enforce-spf.md
Adrià Casajús 046748c443
Update pre-commit (#1138) 
* Update pre-commit

* Upgrade djlint, remove flake8 and add pylint

* Reformat with new djlint version

* Run pre-commit on CI

* Use only python3.10 on CI

* Reformat files with pre-commit

* Run pre-commit against all files

* Reformat

* Added global excludes

* Added pre-commit to the contributing file

* Set python 3.9 as default

* Set language version to python3

Co-authored-by: Adrià Casajús <adria.casajus@proton.ch>
Co-authored-by: Carlos Quintana <carlos.quintana@proton.ch>
2022-07-04 16:01:04 +02:00

1.3 KiB
Raw Blame History

Some email services like Gmail, Protonmail, etc don't have a strict SPF record (-all) to support the "classic" email forwarding that is usually used for group mailing list. In this scenario, an email is sent to a group is forwarded as-is, breaking therefore the SPF.

A malicious hacker could use this security fail to impersonate your alias via the reverse-alias. This rarely happens as the reverse-alias is generated randomly and is unique for each sender.

However if you want to prevent this kind of attack, you can enforce the SPF policy even if your mailbox uses a "soft" policy.

  1. Install postfix-pcre
apt install -y postfix-pcre
  1. Add /etc/postfix/body_checks.pcre file with the following content
/^X-SimpleLogin-Client-IP:/    IGNORE
  1. Add /etc/postfix/client_headers.pcre with the following content
/^([0-9a-f:.]+)$/ prepend X-SimpleLogin-Client-IP: $1
  1. Add the following lines to your Postfix config file at /etc/postfix/main.cf
body_checks = pcre:/etc/postfix/body_checks.pcre
smtpd_client_restrictions = pcre:/etc/postfix/client_headers.pcre
  1. Enable ENFORCE_SPF in your SimpleLogin config file
ENFORCE_SPF=true
  1. Restart Postfix
systemctl restart postfix
  1. Restart SimpleLogin mail handler
sudo docker restart sl-email