Skip to content
Get Stalwart

SPF

An SPF record lists the servers that may send mail with a domain in the SMTP envelope, but on its own it does not tell the domain owner when mail fails the check at a receiving server. SPF failure reporting (RFC 6652) closes that gap: a receiving server tells the domain when mail claiming the domain in the envelope fails its SPF check. A failure points to servers that send in the domain’s name without being listed in its SPF record.

A domain requests reports with modifiers in its SPF record:

  • ra= names the local part of the address to report to.
  • rp=, which is optional, sets the percentage of failures to report.
  • rr=, which is optional, selects the kinds of result to report.

Each report is a message in the Abuse Reporting Format (RFC 6591), a standard format for reports about individual messages.

Stalwart sends an SPF failure report when its SPF check of a domain that requests reports fails. The number of reports is limited by the rate that sendFrequency allows.

The reports are configured on the SpfReportSettings singleton (found in the WebUI under Settings › MTA › Reports › SPF). Each field is an expression evaluated with the MAIL FROM variables. The fields answer two questions: how many reports to send, and what the report message looks like.

sendFrequency decides how many reports go to each report address, as a count and a period. Setting it to false disables SPF failure reports altogether. The default rate of 1 per day limits the reports sent to each address.

The other fields describe the report message:

  • fromName and fromAddress set the display name and the address of the report’s sender.
  • subject sets the subject of the report message.
  • dkimSignDomain sets the domain whose DKIM keys sign the report.

The default sender address and signing domain are built from system('report_domain'). This expression returns the report domain shared by all reports, or the default domain unless the report domain is set.

The following object body disables SPF failure reports:

{
  "sendFrequency": {"else": "false"}
}

Reports also travel in the other direction. Failure reports that other servers send about the domains hosted on Stalwart are analysed as described in Analysis.