7

When using a tool like https://dkimvalidator.com/ to verify configuration of DKIM, SPF, DMARC, etc. for sending mail from a web server, I get a warning like this:

0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record

It seems like a bad signal even though the score isn't really affected. How do I get rid of it?

glts
  • 681
  • 4
  • 14
Walf
  • 293
  • 1
  • 3
  • 16

2 Answers2

8

Publish SPF records for HELO/EHLO hostnames

The Sender Policy Framework does not only protect MAIL FROM, but also HELO. Whereas the MAIL FROM identity MUST be verified (RFC 7208, 2.4), the verification of the HELO identity is only RECOMMENDED (RFC 7208, 2.3). This is the reason Spamassassin (rules/25_spf.cf), where this scoring comes from, only gives 0.0 by default.

In your own answer, you suggest changing the HELO hostname to match the domain, but that is not the only solution – and not the best solution in all cases. Some receiving systems gives negative scoring if the hostname in the HELO command does not match with the reverse DNS PTR record (SMTP Reverse DNS Mismatch). This is why you might want to add an SPF record for your HELO hostname, instead. (SPF FAQ / Common mistakes / Publish SPF records for HELO/EHLO names used by your mail servers.)

Publish SPF records for every hostname

Furthermore, every hostname with an A record that is not intended for sending email should be protected with SPF, too. Otherwise, anyone can use them as an envelope sender. (SPF FAQ / Common mistakes / Publish null SPF records for your domains that don't send mail; related answer.)

Esa Jokinen
  • 43,252
  • 2
  • 75
  • 122
  • 1
    Thanks for the extra info. My `PTR` already matches, and I do publish `-all` SPF for mail-less domains. Mine is a case of `machine-name.domain.example` being the domain I used when setting up the web server that serves `domain.example`. – Walf May 19 '21 at 10:10
3

It was as simple as adding the below setting in /etc/postfix/main.cf:

smtp_helo_name = $mydomain

The message changes to this:

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

Walf
  • 293
  • 1
  • 3
  • 16
  • Great, this fixes it! But it appears to add another issue: `Your reverse DNS does not match with your sending domain.`, as the HELO banner uses `example.com` instead of the correct `mail.example.com`. – strarsis Jun 14 '22 at 15:17
  • @strarsis See the other answer, this works for me because my PTR/rDNS matches. You need to change that record, which is controlled by your hosting service/network provider, not part of your domain's records. Or change your HELO to be the same as your existing rDNS record. – Walf Jun 15 '22 at 01:02