Enhancement Request: SPF/DKIM authenticated domains

[314159]

Hi,

I would suggest an improvement to postgrey, in that, if a email is sent, and the address is SFP/DKIM authenticated, then use the domain name in place of the IP address for postgrey.

This means that sites like google or facebook that never seem to use the same IP address to send a mail would be handled automatically and would not need to be whitelisted.

[schweikert]

I agree that it would be really useful, but this information is not available in the postfix access policy delegation protocol, so postgrey would need to do DNS lookups. With the current architecture of the daemon, this would not be possible in a performant and reliable way.

[Haravikk]

I came to post essentially the same idea.

I'm assuming the performance concern is that postgrey is designed to receive incoming message details and respond as quickly as possible, which waiting for a (presumably blocking) SPF query would cause to slow down by a significant amount?

What if instead, new entries were marked as "SPF unknown", and processed by a background daemon instead? This way postgrey can continue to respond to queries with the data it has available at the time, but after the background daemon has checked for SPF details this data can be included for any requests that come in later. Unless the SPF lookup is very slow, it should still avoid false positives pretty quickly.

For example:

1. postgrey receives a message from the unknown @example.org, delivered by foo.mailjet.com
2. postgrey stores foo.mailjet.com for @example.org and delays as normal
3. postgrey receives delayed message, marks tuple as allowed but with SPF unknown
4. background daemon runs, grabbing SPF data for example.org (may require multiple queries if it uses the import directive). Data is stored.
5. postgrey receives a new message from known @example.org but from unknown bar.mailjet.com, however it has SPF data for example.org which lists bar.mailjet.com as a valid sender, allowing the message to be passed immediately.

Something like that perhaps?

[Wesba]

Not to do full SPF check, but simple DNS query for check existence of SPF record. Domains that contain -all policy could be white listed. And let SPF policy demon to do filtering.
Domains that have ~all policy (softfail) should be gray listed.

[mnalis]

Domains that contain -all policy could be white listed

As basically 95%+ of the spammers do to on their throwaway domains, that would be counterproductive IMHO.