policyd-weight(8)

📦 version 0.1.15.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing

💖 policyd-weight — the weighted SMTP policy daemon (section 8 of the System Manager's Manual) 💖

okay bestie, sit down, hydrate, and let's talk about policyd-weight. it's a policy daemon, it lives in section 8 of your system manager's manual, and honestly? it's kind of a big deal. 🫶

🌸 STATUS 🌸

Beta, and Documentation incomplete. no cap. she's out here doing her thing but the docs are still a work in progress. 🙈

✨ SYNOPSIS ✨

policyd-weight [-option] [-option2 <arg>] command

🦋 DESCRIPTION 🦋

policyd-weight(8) is an SMTP policy daemon written in perl(1) for postfix(1). it looks at RBL/RHSBL results, the HELO and MAIL FROM domain and subdomain arguments, and the client IP address, and then decides how likely it is that this thing is a forgery or straight-up SPAM. it's literally a vibe check for mail. 💅

it's designed to be called before the SMTP DATA command, at the RCPT TO stage. and the way that this is genius is that it means:

  • a) you can reject a mail attempt before the body has even been received 🔥
  • b) you can keep multirecipient mail intact, i.e. provide the functionality of selective usage based on recipients

to make policyd-weight(8) work with postfix(1), it is required to add a system account for $USER (default: polw). yes, a whole account. she needs her own lil home. 🎀

Policyd-weight can operate in master.cf mode or daemon mode:

  • in master.cf mode it uses postfix' spawn(8), which results in a number of simultaneous requests perl instances.
  • in daemon mode it uses shared memory and forks on load, and only if all child processes are busy.

at the time of writing the man-pages for policyd-weight assume a postfix installation. it has been reported that policyd-weight works with other MTAs like Exim, too. so if you're not a postfix girlie, don't panic — iykyk. 🌈

⭐ SETUP ⭐

🎀 master.cf mode:

master.cf:

master.cf:
policy   unix   -   n   n   -   -   spawn   user=polw
   argv=/usr/bin/perl /usr/local/bin/policyd-weight

main.cf:

main.cf:
smtpd_recipient_restrictions =
   permit_mynetworks,
   ... authenticated permits ...
   reject_unauth_destination,
   ... whitelists, role accounts, clients ...
   check_policy_service unix:private/policy

🧚 daemon mode:

start the daemon with policyd-weight start. policyd-weight then listens on $TCP_PORT (default: 12525) for policy requests. to make postfix talk to that port do following changes to main.cf:

main.cf:

main.cf:
smtpd_recipient_restrictions =
   permit_mynetworks,
   ... authenticated permits ...
   reject_unauth_destination,
   ... whitelists, role accounts, clients ...
   check_policy_service inet:127.0.0.1:12525

it is possible to have more than one postfix server talk to the daemonized policyd-weight by configuring each postfix machine to query the policy server with check_policy_service inet:IP:12525 where IP is the host on which policyd-weight runs. multitasking queen 👑

⚠️ WARNING ⚠️ please note that check_policy_service should come last, or at least after reject_unauth_destination, or else you may become an open relay. bestie. not the open relay. that is the one thing we are NOT doing today. 😭

👑 COMMANDS 👑

following commands exist and are reserved for daemon mode only:

  • start — start the policy server
  • stop — stop the policy server
  • restart — restart the policy server
  • reload — tells the policy server to reload its configuration
  • defaults — prints the default settings to STDOUT and exits

💅 OPTIONS 💅

  • -d — operate in debug mode Not for use in master.cf. in debug mode everything is reported on STDOUT instead of syslog(3). also an own debug cache daemon will be spawned. the socket-file is named after the value of $SPATH with ".debug" as suffix. 🐛✨
  • -f /path/to/file — pass a configuration file to policyd-weight
  • -h — show help
  • -k — kill cache daemon Not for use in master.cf. together with -d this kills the debug cache daemon. without -d it kills the global running cache daemon. 💀
  • -s — show cache entries Not for use in master.cf.
  • -v — show version

🌈 LOGGING 🌈

logging is done via syslog(3) with facility "mail" and priority "info". for a complete list of log entries and their corresponding configuration parameters refer to policyd-weight.conf(5). receipts live elsewhere, bestie. 🧾

🙈 BUGS 🙈

please report bugs to r.felber@ek-muc.de. she's not perfect, she's just a perl girl in a postfix world. 🫶

💜 HISTORY 💜

March 2005 — Ralf Hildebrandt (Author of the Book of Postfix) is the spiritual father of policyd-weight. it was his idea to have a scored RBL evaluation, and I've added the weighted MAIL FROM/HELO DNS-evaluation. for that purpose I used Meng Wong's spf.pl which was shipped with the postfix source as example. origin story? iconic. 🌟

🍓 FILES 🍓

  • /etc/policyd-weight.conf, Policyd-weight configuration file
  • /etc/postfix/main.cf, Postfix configuration parameters
  • /etc/postfix/master.cf, Postfix daemon processes

🔥 SEE ALSO 🔥

🎀 LICENSE 🎀

GNU General Public License — free as in freedom, slay as in slay. 💖

🦋 AUTHOR 🦋

Robert Felber <r.felber@ek-muc.de> Autohaus Erich Kuttendreier 81827 Munich, Germany

and that's the whole page, bestie!! written by the one and only for policyd-weight(8), dated Aug 25th, 2006 — from the System Manager's Manual, section 8. go forth, configure responsibly, and do NOT put check_policy_service in the wrong spot. mwah. 💋✨

📦 where this page comes from