[Rspamd-Users] SPF module not found

[Daniel Lysfjord]

"J. Fahrner via Users" <users at lists.rspamd.com> skrev 25. september 2020 kl. 15:23:

> Am 2020-09-25 15:04, schrieb Daniel Lysfjord via Users:
> 
>> Pretty sure the SPF module is enabled by default, confirmed by
>> https://rspamd.com/doc/modules
> 
> Then I'm wondering why this mail was not blocked:
> 
> Return-Path: <noreply at zoll.de>
> Received: from zoll.de (npowrtma.germanywestcentral.cloudapp.azure.com [20.52.59.53])
> by server.fahrner.name (Postfix) with ESMTP id 8B27F88378
> for <xxx at xxx.de>; Thu, 24 Sep 2020 16:38:12 +0200 (CEST)
> Received: by zoll.de (Postfix, from userid 33)
> id A21ED4225E; Thu, 24 Sep 2020 14:21:26 +0000 (UTC)
> To: xxx at xxx.de
> Subject: =?UTF-8?Q?=E2=9C=88_Benachrichtigungen:_Zoll-Kundendienst?=
> X-PHP-Originating-Script: 0:11.php
> Date: Thu, 24 Sep 2020 14:11:45 +0000
> From: deutschepost <noreply at zoll.de>
> Message-ID: <50bd40b036ee8b3e57264c7183268dc7 at zoll.de>
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="154d9f67f5916d40dabb735fc2c72240d"
> Content-Transfer-Encoding: 8bit
> X-Spam: Yes
> 
> Rspamd rating:
> RSPAMD_URIBL (4.5) [wkv.com:url]
> URIBL_RED (3.5) [postoffice-fees.com:email]
> SEM_URIBL_FRESH15 (3) [postoffice-fees.com:email]
> BAYES_HAM (-1.28406) [89.93%]
> AUTH_NA (1)
> PHP_SCRIPT_ROOT (1)
> URI_COUNT_ODD (1) [1]
> HAS_ANON_DOMAIN (0.1)
> MIME_GOOD (-0.1) [multipart/alternative,text/plain]
> R_DKIM_NA (0)
> GREYLIST (0) [greylisted,Thu, 24 Sep 2020 14:27:06 GMT,new record]
> MIME_TRACE (0) [0:+,1:+,2:~]
> MID_RHS_MATCH_FROM (0)
> RCVD_COUNT_ZERO (0) [0]
> TO_DN_NONE (0)
> R_SPF_NA (0) [no SPF record]
> FROM_EQ_ENVFROM (0)
> DMARC_NA (0) [zoll.de]
> FROM_HAS_DN (0)
> RCPT_COUNT_ONE (0) [1]
> ARC_NA (0)
> TO_MATCH_ENVRCPT_ALL (0)
> HAS_X_POS (0)
> ASN (0) [asn:8075, ipnet:20.48.0.0/12, country:US]
> --
> Users mailing list
> Users at lists.rspamd.com
> https://lists.rspamd.com/mailman/listinfo/users

R_SPF_NA (0) [no SPF record] <- probably because of that? What DNS servers are you using? Are your local dns pretending to be authorative for the sending domain?

Try to enable some debugging, and see what's going on, both on rspamd itself, and the dns service you're using (if you're using a local one).