Message rejected due to: SPF fail - not authorized

[PeterGDSoft]

Hi, I have a problem receiving an email in DMS when I send it from my domain used in google workspace. Emails from other domains are normally received, but when I send from my company email from my domain, I get a return message:

550 5.7.23 : Recipient address rejected: Message rejected due to: SPF fail - not authorized.

And an error in DMS

2024-11-13T12:54:55.158428+00:00 mail policyd-spf[1311]: : 550 5.7.23 Message rejected due to: SPF fail - not authorized.
2024-11-13T12:54:55.158540+00:00 mail postfix/smtpd[1301]: NOQUEUE: reject: RCPT from dockermail[172.19.0.1]: 550 5.7.23 <me@my_domain.com>: Recipient address rejected: Message rejected due to: SPF fail - not authorized.; from=<me@gmail_workspace_domain.com> to=<me@my_domain.com> proto=ESMTP helo=<mail-oo1-xc2a.google.com>
2024-11-13T12:54:55.290301+00:00 mail postfix/smtpd[1301]: disconnect from dockermail[172.19.0.1] ehlo=2 starttls=1 mail=1 rcpt=0/1 bdat=0/1 quit=1 commands=5/7

The important thing is that normally from this google workspace email I can send messages to other servers like gmail etc.

SPF record for the domain used in google workspace

v=spf1 a mx include:_spf.google.com -all

I found that setting the option

PERMIT_DOCKER=host

fixes the problem, but isn't that just a workaround so that it doesn't check the spf and it's a security issue?

[PeterGDSoft]

There is a good chance that the problem is IPv6 related, isn't adding these ipv6 related values to docker (version 27.3.1) to daemon.json and creating a network for DMS with ipv6 some kind of security issue?

{
  "ip6tables": true,
  "experimental" : true,
  "userland-proxy": true
}

and by the way after doing this it works, however this site still says my mail is not reachable from ipv6 even though AAAA dns exists

https://internet.nl/test-mail/

[polarathene]

I found that setting the option PERMIT_DOCKER=host fixes the problem,
but isn't that just a workaround so that it doesn't check the spf and it's a security issue?

Did you also use network: host? Normally you don't want ENV. It's to relax/drop security measures in DMS when you're certain it's safe to allow connections from those IP to bypass the security restrictions in place.

PERMIT_DOCKER=host would allow any IP address within the /16 subnet available to DMS: 192.168 / 172.x / 10.0 / (other interface IPv4 here)

docker-mailserver/target/scripts/startup/setup.d/networking.sh

Lines 61 to 62 in b960efa

	( 'host' )
	__add_to_postfix_mynetworks 'Host Network' "${CONTAINER_NETWORK}/16"

docker-mailserver/target/scripts/startup/setup.d/networking.sh

Lines 16 to 18 in b960efa

	CONTAINER_IP=$(ip addr show "${NETWORK_INTERFACE}" | \
	grep 'inet ' | sed 's|[^0-9\.\/]*||g' | cut -d '/' -f 1)
	CONTAINER_NETWORK=$(echo "${CONTAINER_IP}" | cut -d '.' -f1-2).0.0

The default PERMIT_DOCKER=none should be preferred, better to identify and understand your actual issue if you care about security.

---

isn't adding these ipv6 related values to docker (version 27.3.1) to daemon.json and creating a network for DMS with ipv6 some kind of security issue?

No.

Although from v27 of Docker ip6tables should be true by default when IPv6 is available on the host IIRC, and experimental no longer relevant for that feature. userland-proxy is also true by default AFAIK.

The security issue as pointed out by our docs is when you don't have IPv6 configured for the container but have userland-proxy: true in /etc/docker/daemon.json and the container can be reached via IPv6 on the host.

That allows any external host to connect to DMS via IPv6 on the host but route through the bridge gateway IPv4 address associated to that container. If there is any subnet trust in place (eg: PERMIT_DOCKER=host) then all these connections are implicitly trusted even though they're not from that private IPv4 subnet but public IPv6 connections.

by the way after doing this it works, however this site still says my mail is not reachable from ipv6 even though AAAA dns exists

• Disable userland-proxy setting and that IPv6 to IPv4 routing will fail, avoiding the security issue.
• Alternatively prevent IPv6 connections to the host (remove the AAAA DNS record), or better ensure the DMS container is assigned an IPv6 IP address (private ULA is fine as per our IPv6 docs guide).