** Description changed:
- /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt installed by
- exim4-config.
+ [ Impact ]
+
+ The exim4-config package ships an optional SPF check in the recipient ACL
+ (/etc/exim4/conf.d/acl/30_exim4-config_check_rcpt, enabled via the
+ CHECK_RCPT_SPF macro together with the spf-tools-perl package). It calls the
+ external spfquery.mail-spf-perl helper via Exim's ${run} expansion:
+
+ condition = ${run{/usr/bin/spfquery.mail-spf-perl \
+ --ip ${quote:$sender_host_address} \
+ --scope mfrom \
+ --identity ${quote:$sender_address}} ...
+
+ The envelope sender is wrapped in ${quote:...}, ${run} splits its
+ command string into arguments *before* expansion rather than after. As a
+ result, the double quotes that ${quote:} inserts around the address are
+ passed to spfquery literally, e.g. the --identity argument becomes:
+
+ "[email protected]"
+
+ spfquery cannot parse a domain out of the quoted string, so instead of
+ returning the real SPF verdict it returns "none" (exit code 6) for every
+ message. Because the ACL only rejects on exit code 1 (fail), the deny can
+ never fire: SPF enforcement is silently non-functional for everyone who has
+ enabled CHECK_RCPT_SPF. No mail is ever rejected or marked on the basis of
+ SPF, and every message is stamped "Received-SPF: none" regardless of the
+ sender's actual SPF policy.
+
+ [ Test Plan ]
+
+ On an affected system:
+
+ 1. Install the SPF helper and enable the check:
+ $ sudo apt install spf-tools-perl
+ $ echo 'CHECK_RCPT_SPF=1' | sudo tee -a /etc/exim4/exim4.conf.localmacros
+ $ sudo update-exim4.conf
+
+ 2. Simulate an inbound SMTP session from a known-good sender IP
+ (209.85.128.1 is a genuine Google outbound host) using a sender whose
+ domain publishes SPF:
+
+ exim4 -d -bhc 209.85.128.1 <<'EOF'
+ helo me
+ mail from:<[email protected]>
+ rcpt to:<postmaster@localhost>
+ quit
+ EOF
+
+ 3. In the debug output, inspect the "direct command after expansion" block
+ and the generated Received-SPF header.
+
+ Without the fix (broken):
+ argv[6] = '"[email protected]"' <- literal quotes
+ Received-SPF: none ... <- wrong; gmail.com publishes SPF
+
+ With the fix (correct):
+ argv[6] = '[email protected]'
+ Received-SPF: pass ... <- real gmail.com policy
evaluated
+
+ gmail.com always publishes an SPF record, so a result of "none" is itself
+ proof the query failed. A "pass" (from a legitimate Google IP) confirms
+ spfquery is now evaluated correctly.
+
+ [ Where problems could occur ]
+
+ The change only removes the two ${quote:...} wrappers from the spfquery
+ command line; the ACL decision logic (deny on fail, defer on temperror, the
+ Received-SPF header mapping, and the error-logging warn) is unchanged.
+
+ - The affected block is behind the CHECK_RCPT_SPF macro, which is undefined
+ by default, so the default configuration is unaffected and the vast
+ majority of installations see no change at all.
+
+ - Only sites that have explicitly enabled CHECK_RCPT_SPF and installed
+ spf-tools-perl are touched. For them the change is strictly a fix: a
+ previously dead check begins functioning. Such sites should be aware that
+ SPF rejection will now actually take effect, so a misconfigured local SPF
+ setup could start rejecting mail that was previously (incorrectly) always
+ accepted.
+
+ - This is a configuration-file (conffile) change only; no binary or daemon
+ behaviour is altered.
+
+ [ Other Info ]
+
+
+ -----
+ /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt installed by exim4-config.
Line 289: --identity ${quote:$sender_address}} \
This puts "" around the email address and the IP address and then Exim
itself puts '' around each parameter so the email_address becomes
'"[email protected]"'. This causes spfquery to fail.
You can verify this with:
$ '/usr/bin/spfquery.mail-spf-perl' '--ip' '"1.1.1.1"' '--identity'
'"[email protected]"'
Corrected:
$ '/usr/bin/spfquery.mail-spf-perl' '--ip' '1.1.1.1' '--identity'
'[email protected]'
For best effect, use a valid email address.
Fix (remove the ${quote: functions):
- condition = ${run{/usr/bin/spfquery.mail-spf-perl \
- --ip $sender_host_address \
- --scope mfrom \
- --identity $sender_address} \
- {no}{${if eq {$runrc}{1}{yes}{no}}}}
-
+ condition = ${run{/usr/bin/spfquery.mail-spf-perl \
+ --ip $sender_host_address \
+ --scope mfrom \
+ --identity $sender_address} \
+ {no}{${if eq {$runrc}{1}{yes}{no}}}}
If you use a static exim4.conf, this ACL will surface the issue:
warn condition = ${run{/usr/bin/spfquery.mail-spf-perl --ip
$sender_host_address --identity $sender_address}{yes}{yes}}
logwrite = Output of spfquery: $value rc: $runrc
Test with:
$ exim4 -d -bhc 1.1.1.1
helo me
mail from:[email protected]
rcpt to:[email protected]
(scroll back up until you find the result of the command expansion and
the logwrite)
Docs:
https://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html
(search for ${run)
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: exim4-config 4.97-4ubuntu4.7
ProcVersionSignature: Ubuntu 6.8.0-138.138-generic 6.8.12
Uname: Linux 6.8.0-138-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Wed Aug 26 17:03:23 2026
PackageArchitecture: all
SourcePackage: exim4
UpgradeStatus: Upgraded to noble on 2025-04-14 (499 days ago)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165160
Title:
SPF handling in Exim4 incorrectly quotes the email address
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/exim4/+bug/2165160/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
