Проверка SPF для exim в Debian GNU/Linux

# aptitude update
# aptitude install libmail-spf-query-perl

По непонятной причине, в пакете нет init скрипта для запуска демона [2], так что создаем его ручками в /etc/init.d/spfd

#!/bin/sh

USER=mail
GROUP=mail

SOCK=/var/run/spfd/spfd.sock
PID=/var/run/spfd/spfd.pid

SPFD=/usr/sbin/spfd
DESC="SPF Daemon"

ARGS="-path=${SOCK} -setuser=${USER} -setgroup=${GROUP} -pathuser=${USER} -pathgroup=${GROUP}"


case "$1" in
    start)
        echo -n "Starting $DESC:"
            start-stop-daemon --start --quiet --background --make-pidfile \
                --pidfile ${PID} \
                --exec ${SPFD} -- ${ARGS}
        echo "."
        ;;

    stop)
        echo -n "Stopping $DESC:"
            start-stop-daemon --stop --quiet --oknodo --signal 9 --pidfile "${PID}"
            rm -f $SOCK $PID
        echo "."
        ;;

    restart|force-reload)
        /etc/init.d/spfd stop
        /etc/init.d/spfd start
        ;;

    *)
        N=/etc/init.d/$NAME
        echo "Usage: $N {start|stop|restart|force-reload}" >&2
        exit 1
        ;;
esac

exit 0

и создаем парочку директорий:

# mkdir /var/run/spfd
# chown mail:mail /var/run/spfd

 Добавляем в автозагрузку:

# update-rc.d spfd defaults 19

И изменяем конфигурацию exim, для взаимодействия с демоном [3,4]: 

spf_rcpt_acl:

    # Check envelope sender

    warn     set acl_m8  = $sender_address
    deny     !acl        = spf_check     
    warn     message     = Received-SPF: $acl_m8 ($acl_m7)
    accept                                               

spf_from_acl:

    # Check header From:

    warn     set acl_m8  = ${address:$h_from:}
    deny     !acl        = spf_check         
    warn     message     = Received-SPF: $acl_m8 ($acl_m7)
    accept                                               

spf_check:

    warn     set acl_m9  = ${readsocket{/var/run/spfd/spfd.sock}\
                           {ip=$sender_host_address\n\
                           helo=${if def:sender_helo_name\
                           {$sender_helo_name}{NOHELO}}\ 
                           \nsender=$acl_m8\n\n}{20s}{\n}{socket failure}}

    # Defer on socket error

    defer    condition   = ${if eq{$acl_m9}{socket failure}{yes}{no}}
             message     = Cannot connect to spfd                   

    # Prepare answer and get results

    warn     set acl_m9  = ${sg{$acl_m9}{\N=(.*)\n\N}{=\"\$1\" }}
             set acl_m8  = ${extract{result}{$acl_m9}{$value}{unknown}}
             set acl_m7  = ${extract{header_comment}{$acl_m9}{$value}{}}

    # Check for fail

    deny     condition   = ${if eq{$acl_m8}{fail}{yes}{no}}
             message     = ${extract{smtp_comment}{$acl_m9}{$value}{}}
             log_message = Not authorized by SPF                      

    accept

acl_check_mail:
   
  accept authenticated = *
  deny    message       = $sender_host_address is not allowed to send mail from $sender_address_domain
          !acl          = spf_rcpt_acl
          hosts         = !+relay_from_hosts
  accept

acl_check_data:
  deny senders = :
       !acl = spf_from_acl
  accept

Если вы хоть немного знакомы с настройкой exim, этот пример не вызовет затруднений. В крайнем случае есть замечательная документация [5].

Запускаем spfd и перезапускаем exim:

# invoke-rc.d spfd start
# invoke-rc.d exim4 restart