Demo
Demo

Knowledge base

PMTA knowledge base›Block <source>›Directive§ 3.3.7.21

trace-spf-check

<source>

Whether to put all queries made during verification into the message header
in the configuration this is a linetrace-spf-check falseinside the block <source>
Investigation at the cost of message size

Adds to the header with verification results all DNS queries that were needed for it. The default is not to add them.

The benefit is one and clear: when verification gives an unexpected result, this trace shows exactly what the node asked and what it was told. Without it all that remains is to repeat the verification by hand and hope DNS answers the same way.

The trace stays in the message. It is not written to the log — it is added to the message itself and reaches the recipient, the handler, the archive.

The main trap is that the trace leaves with the message. A complex SPF record generates a dozen queries, and all of them end up in the header of the accepted message. That means noticeable size and internal details of your name resolution in someone else’s mailbox.
What the Hub does. It does not write it: input verification is not enabled. And this trace would be worth enabling only for the duration of an investigation — like the other debugging switches.
Recommended values

Only for the duration of an investigation. And with a comment saying when it was enabled.

Not on a production flow. A dozen extra lines in every accepted message add up quickly.

Manually is often enough. The check command on the node shows the same thing without adding anything to messages.

The advice to use a manual check instead of the trace is ours. From the manual come the default and the composition of the trace: all DNS queries.
Example configuration
# TEMPORARY: investigating the verification of one sender
<source 198.51.100.0/24>
    check-spf-inbound true
    trace-spf-check true</source>
The source is narrowed to one network on purpose: the trace will get only into messages from there, not into all accepted mail.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends1 mistake▶

Leaving it on after the investigation

our experience

What it costsEvery accepted message carries a dozen lines of service trace — both to the recipient and into the archive. Size grows, and name resolution details leak outward.
How to spot itDNS queries are visible in message headers.
How to do it rightTurn it off; for an investigation set it with a comment.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
trace-spf-check <boolean>
Values
yes or no; true and false are accepted on a par with them
Default
false § 3.3.7.21
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
<source>
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The value is set in a <source> block and applies to mail submitted through a matching source; with several matching blocks the most specific wins. It triggers only with check-spf-inbound enabled. It is picked up by pmta reload.
⇄

Related directives

1 relation

Does not work without

check-spf-inbound<source>The line does not trigger until inbound checking is enabled. § 3.3.7.21

How to check on the node
The value is set in the source configuration; the result is visible in the header of the accepted message:
grep -n trace-spf-check /etc/pmta/config
grep -i 'Authentication-Results' /var/log/pmta/pmta.log | tail -3
The trace is added to the same header as the verification result — and travels with the message. The Hub does not write this line.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇Two inbound report processors and what to do with themBounces by message and complaints are parsed by two identically structured blocks; each has its own address list and its own pair of decisions about the message’s fate.◇Address lists — named and unnamedA list of addresses, domains, patterns or hashes; a named one is attached by directives such as suppression, an unnamed one lives inside an inbound mail processor.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Receiving inbound mail
Neighboring settings of the block <source>:log-commandslog-tlslog-connectionstrace-dkim-checklog-dataAll 74 directives of the block →