How to reject SPF failures without SpamAssassin

Introduction

Some system administrators want their servers to reject messages that fail SPF checks without enabling SpamAssassin. This article provides the steps to configure Exim to reject messages that fail SPF checks.

Procedure

1. Log into WHM as the ‘root’ user.
2. Navigate to "Home / Service Configuration / Exim Configuration Manager."
3. Click the "Advanced Editor" tab.
4. Scroll down to the "custom_end_identify_sender" option.
5. Ensure that the "custom_end_identify_sender" option is selected.
6. Enter the following in the "custom_end_identify_sender" textbox.

   deny spf = fail
        message = $sender_host_address is not allowed to send mail from \
                  ${if def:sender_address_domain \
                       {$sender_address_domain}{$sender_helo_name}}. \
                  Please see http://www.open-spf.org/Why;\
                  identity=${if def:sender_address_domain \
                  {$sender_address}{$sender_helo_name}};\
                  ip=$sender_host_address

7. Scroll to the bottom of the page.
8. Click the "Save" button.

Additional resources

Exim Configuration Manager: Custom ACLs