Wenn man bei Office365 oder Google Apps for Business einen eigenen Mailserver (Postfix) vorschalten möchte beim versenden/empfangen muss man die Mailserver von Microsoft/Google Whitelisten in den mynetworks bei Postfix.
Das Script löst alle SPF Record includes auf und generiert CIDR Maps die sich in Postfix einbinden lassen.
Beispiel:
max@dev1:~$ python get_subnets_of_spf_record_mynetwoks.py Working on job office365 Working on job google
Es werden 2 Files erzeugt:
max@dev1:~$ cat /etc/postfix/networks/google 64.18.0.0/20 OK 64.233.160.0/19 OK 66.102.0.0/20 OK 66.249.80.0/20 OK 72.14.192.0/18 OK 74.125.0.0/16 OK 108.177.8.0/21 OK 173.194.0.0/16 OK 207.126.144.0/20 OK 209.85.128.0/17 OK 216.58.192.0/19 OK 216.239.32.0/19 OK [2001:4860:4000::]/36 OK [2404:6800:4000::]/36 OK [2607:f8b0:4000::]/36 OK [2800:3f0:4000::]/36 OK [2a00:1450:4000::]/36 OK [2c0f:fb50:4000::]/36 OK 172.217.0.0/19 OK 108.177.96.0/19 OK max@dev1:~/test$ cat /etc/postfix/networks/office365 207.46.101.128/26 OK 207.46.100.0/24 OK 207.46.163.0/24 OK 65.55.169.0/24 OK 157.56.110.0/23 OK 157.55.234.0/24 OK 213.199.154.0/24 OK 213.199.180.0/24 OK 157.56.112.0/24 OK 207.46.51.64/26 OK 157.55.158.0/23 OK 64.4.22.64/26 OK 40.92.0.0/14 OK 40.107.0.0/17 OK 40.107.128.0/17 OK 134.170.140.0/24 OK [2a01:111:f400::]/48 OK 23.103.128.0/19 OK 23.103.198.0/23 OK 65.55.88.0/24 OK 104.47.0.0/17 OK 23.103.200.0/21 OK 23.103.208.0/21 OK 23.103.191.0/24 OK 216.32.180.0/23 OK 94.245.120.64/26 OK [2001:489a:2202::]/48 OK
In Posftix werden sie in der main.cf eingebunden:
# ----------------------------------------------------------------------
# My Networks
# ----------------------------------------------------------------------
mynetworks =
cidr:/etc/postfix/networks/local
cidr:/etc/postfix/networks/other
cidr:/etc/postfix/networks/google
cidr:/etc/postfix/networks/office365
Da sich zwischendurch die Records auch mal ändern können empfiehlt es sich einen Cronjob dafür einzurichten. Ich habe eine Variante mit diff die nur patcht wenn das Resultat nicht null ist.
Das Script lässt sich auch noch für andere Dienste / etc. anpassen:
lookup_spf = {
# Google Apps for Business
"google": {
"domain": "google.com",
"file" : "/etc/postfix/networks/google",
},
# Office365
"office365": {
"domain": "spf.protection.outlook.com",
"file" : "/etc/postfix/networks/office365",
},
# Example
"example": {
"domain": "example.com",
"file" : "/etc/postfix/networks/example",
},
}
Sourcecode:
#!/usr/bin/env python
#
# get_subnets_of_spf_record_mynetwoks.py
# Resolve all known ip addresses from spf record and generate cidr map for postfix
#
# Version 1.0
# Written by Maximilian Thoma (http://www.lanbugs.de)
#
# The generated files can be used in postfix config with for example mynetworks = cidr:/etc/postfix/<generated_file>
#
# This program is free software; you can redistribute it and/or modify it under the terms of the
# GNU General Public License as published by the Free Software Foundation;
# either version 2 of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
# without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along with this program;
# if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,
# MA 02110, USA
#
#
# Requirements:
# dnspython module -> pip install dnspython
#
import dns.resolver
from dns.exception import DNSException
import re
import sys
# Look for DNS Record at:
#
# "jobname": {
# "domain": "domainname",
# "file": "output_file",
# }
#
#
lookup_spf = {
# Google Apps for Business
"google": {
"domain": "google.com",
"file" : "/etc/postfix/networks/google",
},
# Office365
"office365": {
"domain": "spf.protection.outlook.com",
"file" : "/etc/postfix/networks/office365",
},
}
############################################################################################
def getspf(record, filehandler):
# Init Resolver
myResolver = dns.resolver.Resolver()
try:
# Try to lookup TXT record
myAnswer = myResolver.query(record,"TXT")
except DNSException:
sys.stderr.write("Failed to query record, SPF broken.")
return
results = []
for rdata in myAnswer:
# Get string out of records
for txt_string in rdata.strings:
# Append to SPF Records buffer if "spf" in string
if "spf" in txt_string:
results.append(txt_string)
# If results >=1
if len(results) >= 1:
# Work on records
for spf in results:
# Split parts
parts = spf.split(" ")
# Check parts
for part in parts:
s_include = re.match(r"^include:(?P<domain>.*)$", part)
s_ip4 = re.match(r"^ip4:(?P<ip4>.*)$", part)
s_ip6 = re.match(r"^ip6:(?P<ip6>.*)$", part)
# If in part "include" found, next round
if s_include:
getspf(s_include.group('domain'), filehandler)
# elif ip4 found
elif s_ip4:
filehandler.write(s_ip4.group('ip4') + " OK\n")
# elif ip6 found
elif s_ip6:
filehandler.write("[" + s_ip6.group('ip6').replace("/","]/") + " OK\n")
# else no valid record
else:
pass
# no results
else:
sys.stderr.write("No results")
pass
def main():
# Working on jobs
for jobname, config in lookup_spf.iteritems():
print "Working on job %s" % jobname
# open file
filehandler = open(config['file'], 'w')
# start query spf records
getspf(config['domain'], filehandler)
# close file
filehandler.close()
#getspf(lookup_spf)
if __name__ == "__main__":
main()
oder
https://gist.github.com/lanbugs/b223e16ae52e681bb5c9401c36fd5f1a