Mail Protection: SMTP, POP3, Antispam and Antivirus Where is successful SPF check documented

UTM Firewall requires membership for participation - click to join

Thread Info

State Verified Answer
Locked Locked
Replies 3 replies
Subscribers 4 subscribers
Views 2131 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Where is successful SPF check documented

flomb over 3 years ago

Where does the UTM document whether it successfully validated SPF records? and with which IP and or Domain it was validated?

I have to investigate a phishing campaign and i have access to the email itself as well as the smtp log file.

In neither of them i can see any SPF check results.

SPF is and was enabled.

This thread was automatically locked due to age.

Top Replies

BAlfson over 3 years ago +1

Hallo, The sending domain must specify SPF for it to be checked. In the SMTP Proxy log, search for SPF and spf to see passes and failures. Post the headers from the email here with your private information…

Parents

0 DouglasFoster over 3 years ago

You may want to review this post, where I provide general information about parsing and interpreting the SMTP log filee. I don't do SPF checks in UTM, so it is not called out in my document, but it would certainly be part of the EXIM-IN phase.

https://community.sophos.com/utm-firewall/f/mail-protection-smtp-pop3-antispam-and-antivirus/114272/how-to-analyze-the-smtp-log-file
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 DouglasFoster over 3 years ago

You may want to review this post, where I provide general information about parsing and interpreting the SMTP log filee. I don't do SPF checks in UTM, so it is not called out in my document, but it would certainly be part of the EXIM-IN phase.

https://community.sophos.com/utm-firewall/f/mail-protection-smtp-pop3-antispam-and-antivirus/114272/how-to-analyze-the-smtp-log-file
Cancel
Vote Up +1 Vote Down

Cancel

Children

No Data