Zimbra Tips : How To Enable SPF Checking for Incoming Connection

Home » Zimbra » Zimbra Tips : How To Enable SPF Checking for Incoming Connection
Zimbra 8 Comments

Usually, i am configure spf to my server for outgoing purpose. The spf records are defined in public dns use txt records. But, how to enable spf checking if there connection to my server?

The following is step by step how to enable spf checking for incoming connection.

You need to enable cbpolicyd as in the following guides : https://imanudin.net/2014/09/08/how-to-install-policyd-on-zimbra-8-5/. After enable policyd, please open policyd webui (http://IPZIMBRA:7780/webui/index.php) and create some groups, policy and spf.

# Create Groups

Select Policies | Groups. Select action and add groups. given name list_domain. On comment, you can empty or filled with comment. Select a group that has been made. On action, select members and fill with your domain. See the following example. make sure disabled status is no at groups or members groups


# Create Policy

Select Policies | Main. Add new policy and give name or information like the following picture. Then submit query


select new policy has been made and select members on action. Add member and fill on source/destination with group that has been made. See the following example


Above configuration only check spf if email connection come from external domain (Gmail, Yahoo and etc) to my internal domain. If email connection come from internal domain to internal domain, or internal domain to external domain, spf checking will be ignore/skip. make sure disabled status is no

# Create SPF Check

Select SPF Checks | Configure. Select Add on Action and configure like follow. Then Submit


Make sure disabled status is no. Enable policyd checkspf and restart policyd service

su - zimbra
zmprov ms `zmhostname` zimbraCBPolicydCheckSPFEnabled TRUE
zmcbpolicydctl restart

SPF checking for incoming connection has been enabled and configured. Please see zimbra.log if getting spf fail.

The following is example when getting spf fail

Mar 10 18:45:43 smtp postfix/smtpd[28068]: NOQUEUE: reject: RCPT from c117-167.nanaonet.jp[]: 554 5.7.1 <shaftssg@onet.pl>: Sender address rejected: Failed SPF check; Please see http://www.openspf.org/Why?s=mfrom;id=shaftssg%40onet.pl;ip=;r=smtp.imanudin.net; onet.pl, Sender is not authorized by default to use 'shaftssg@onet.pl' in 'mfrom' identity (mechanism '-all' matched); from=<shaftssg@onet.pl> to=<xxxx@imanudin.net> proto=ESMTP helo=<[]>

Good luck and hopefully useful 😀

8 thoughts on - Zimbra Tips : How To Enable SPF Checking for Incoming Connection

  • Dear Ahmad. I’ve been testing Zimbra for a couple of days now and im looking at the server monitor that the outgoing message count is very high and currently the server only has two test users. How is this possible? Maybe my server is compromised?


  • Hello! You have great posts and I am glad to have found your page.

    I have a question about the above setup. Users that have outlook connected via Imap can not sent messages. They fail the SPF check even though they are authenticated via SMTP. error looks like this.

    Server error: ‘554 5.7.1 : Sender address
    rejected: Failed SPF check; Please see
    ;r=mail.example.net; example.com, Sender is not authorized by default to use
    ‘user@example.com’ in ‘mfrom’ identity (mechanism ‘-all’ matched)’

    What can I do to account for these users. Activate sync and web work with no issues.

  • Sorry for late reply. I did not get notification of your comment. The IP 96.x.y.z is actually the public IP from where the computer with outlook is sitting. Here is an example show more information.

    ## imap user showing home comcast IP when sending to another internal user ##
    Received-SPF: fail (example.com: Sender is not authorized by default to use ‘sanga.c@example.com’ in ‘mfrom’ identity (mechanism ‘-all’ matched)) receiver=mail.example.net; identity=mailfrom; envelope-from=”sanga.c@example.com”; helo=DESKTOP4OH085B; client-ip=
    Received: from DESKTOP4OH085B (c-75-74-180-166.hsd1.fl.comcast.net [])

    Basically when I have outlook configured with IMAP, the email going to internal address gets rejected. But going to external address like gmail.

    ## imap user showing correct mail server public IP when sending to gmail ##
    Received-SPF: pass (google.com: domain of sanga.c@example.com designates as permitted sender) client-ip=;
    Authentication-Results: mx.google.com;
    spf=pass (google.com: domain of sanga.c@example.com designates as permitted sender) smtp.mailfrom=sanga.c@example.com

    Not sure if its my SPF setting or IMAP settings

    • Hello Sangamc,

      It’s seems strange to me. The Public IP should sent from your server instead of from your public IP that used to connect. Please check SMTP outgoing configuration on your Outlook

  • Not sure why the comment is not saving, but here goes again.

    The IP 96.x.y.z is showing as the public IP where the computer with outlook is connecting from. So for example if I am using outlook connected with IMAP from home, the IP that shows is my home Comcast internet IP

  • Ok i have figured out the issue. The main reason I wanted to enable SPF was to block people masquerading as accounting@mydomain.com (a mailbox that does not exist) and sending mail to my staff with cryptovirus.

    I enabled policyD SPF with one extra setting !%internal_ip in addition to !%list_domain.

    This blocked the fake mail as I expected but also blocked IMAP users from outlook since they match the !%internal_ip setting.

    What really needs to be done is:
    – Reject mail from false senders

    – Enforce match between from and SASL username

    – Configure SPF with only the !%list_domain option.

    Now All is working correctly.