cPFence Thanks for your reply and for explaining how the domain whitelist currently works.
I understand that your approach aims to avoid false positives in cases where legitimate domains may not yet have SPF or DKIM properly configured. However, I believe that the lack of any additional verification on domain whitelisting presents a significant security risk — especially because spoofed messages can completely bypass all filters simply by matching a whitelisted domain.
With that in mind, I would like to suggest the following improvement for future consideration:
It would be extremely useful to have a configurable option that applies domain whitelisting only if the message passes SPF or DKIM validation.
This option could be disabled by default, but available to advanced users or security-sensitive environments.
In practice, this would help promote the adoption of best practices such as SPF, DKIM and DMARC, while also preventing the whitelist from being used to circumvent spam and reputation filters — something that is currently possible.
Rather than blocking legitimate emails, the goal would be to give administrators the freedom to choose the desired level of trust for whitelisted domains in their environment.
Thank you once again for your attention, and congratulations on the excellent work you're doing with CPfence.
