Index: refpolicy-2.20261022/policy/modules/services/postfixpolicyd.fc
===================================================================
--- /dev/null
+++ refpolicy-2.20261022/policy/modules/services/postfixpolicyd.fc
@@ -0,0 +1,9 @@
+/etc/policyd\.conf	--	gen_context(system_u:object_r:postfix_policyd_conf_t,s0)
+
+/etc/rc\.d/init\.d/postfixpolicyd	--	gen_context(system_u:object_r:postfix_policyd_initrc_exec_t,s0)
+
+/usr/bin/policyd	--	gen_context(system_u:object_r:postfix_policyd_exec_t,s0)
+/usr/bin/policyd-spf	--	gen_context(system_u:object_r:postfix_policyd_exec_t,s0)
+/usr/bin/postfix-policyd-spf-perl	--	gen_context(system_u:object_r:postfix_policyd_exec_t,s0)
+
+/run/policyd\.pid	--	gen_context(system_u:object_r:postfix_policyd_runtime_t,s0)
Index: refpolicy-2.20261022/policy/modules/services/postfixpolicyd.if
===================================================================
--- /dev/null
+++ refpolicy-2.20261022/policy/modules/services/postfixpolicyd.if
@@ -0,0 +1,36 @@
+## <summary>Postfix policy server.</summary>
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an postfixpolicyd environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`postfixpolicyd_admin',`
+	gen_require(`
+		type postfix_policyd_t, postfix_policyd_conf_t;
+		type postfix_policyd_runtime_t, postfix_policyd_initrc_exec_t, postfix_policyd_unit_t;
+	')
+
+	allow $1 postfix_policyd_t:process { ptrace signal_perms };
+	ps_process_pattern($1, postfix_policyd_t)
+
+	init_startstop_service($1, $2, postfix_policyd_t, postfix_policyd_initrc_exec_t, postfix_policyd_unit_t)
+
+	files_list_etc($1)
+	admin_pattern($1, postfix_policyd_conf_t)
+
+	files_list_runtime($1)
+	admin_pattern($1, postfix_policyd_runtime_t)
+')
Index: refpolicy-2.20261022/policy/modules/services/postfixpolicyd.te
===================================================================
--- /dev/null
+++ refpolicy-2.20261022/policy/modules/services/postfixpolicyd.te
@@ -0,0 +1,76 @@
+policy_module(postfixpolicyd)
+
+# https://launchpad.net/postfix-policyd-spf-perl/
+# The postfix-policyd-spf-perl has not had an upstream release for a while but
+# is well supported in Debian and Ubuntu, upstream just works
+#
+# https://launchpad.net/spf-engine
+# SPF engine AKA postfix-policyd-spf-python had an upstream release in 2024
+########################################
+#
+# Declarations
+#
+
+type postfix_policyd_t;
+type postfix_policyd_exec_t;
+init_daemon_domain(postfix_policyd_t, postfix_policyd_exec_t)
+
+type postfix_policyd_conf_t;
+files_config_file(postfix_policyd_conf_t)
+
+type postfix_policyd_initrc_exec_t;
+init_script_file(postfix_policyd_initrc_exec_t)
+
+type postfix_policyd_unit_t;
+init_unit_file(postfix_policyd_unit_t)
+
+type postfix_policyd_runtime_t alias postfix_policyd_var_run_t;
+files_runtime_file(postfix_policyd_runtime_t)
+
+type postfix_policyd_tmp_t;
+files_type(postfix_policyd_tmp_t)
+
+########################################
+#
+# Local policy
+#
+
+allow postfix_policyd_t self:capability { chown setgid setuid sys_chroot sys_resource };
+allow postfix_policyd_t self:process { setrlimit signal signull };
+allow postfix_policyd_t self:tcp_socket { accept listen };
+
+allow postfix_policyd_t postfix_policyd_conf_t:dir list_dir_perms;
+allow postfix_policyd_t postfix_policyd_conf_t:file read_file_perms;
+allow postfix_policyd_t postfix_policyd_conf_t:lnk_file read_lnk_file_perms;
+
+manage_files_pattern(postfix_policyd_t, postfix_policyd_runtime_t, postfix_policyd_runtime_t)
+files_runtime_filetrans(postfix_policyd_t, postfix_policyd_runtime_t, file)
+
+allow postfix_policyd_t postfix_policyd_tmp_t:file manage_file_perms;
+allow postfix_policyd_t postfix_policyd_tmp_t:sock_file manage_sock_file_perms;
+files_tmp_filetrans(postfix_policyd_t, postfix_policyd_tmp_t, { file sock_file })
+
+kernel_search_network_sysctl(postfix_policyd_t)
+
+corecmd_exec_bin(postfix_policyd_t)
+
+corenet_tcp_sendrecv_generic_if(postfix_policyd_t)
+corenet_tcp_sendrecv_generic_node(postfix_policyd_t)
+corenet_tcp_bind_generic_node(postfix_policyd_t)
+
+corenet_sendrecv_postfix_policyd_server_packets(postfix_policyd_t)
+corenet_tcp_bind_postfix_policyd_port(postfix_policyd_t)
+
+corenet_sendrecv_mysqld_server_packets(postfix_policyd_t)
+corenet_tcp_bind_mysqld_port(postfix_policyd_t)
+
+dev_read_urand(postfix_policyd_t)
+
+files_read_etc_files(postfix_policyd_t)
+files_read_usr_files(postfix_policyd_t)
+
+logging_send_syslog_msg(postfix_policyd_t)
+
+miscfiles_read_localization(postfix_policyd_t)
+
+sysnet_dns_name_resolve(postfix_policyd_t)
Index: refpolicy-2.20261022/policy/modules/admin/cloudinit.te
===================================================================
--- refpolicy-2.20261022.orig/policy/modules/admin/cloudinit.te
+++ refpolicy-2.20261022/policy/modules/admin/cloudinit.te
@@ -776,6 +776,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	postfixpolicyd_admin(cloud_init_t, system_r)
+')
+
+optional_policy(`
 	postgrey_admin(cloud_init_t, system_r)
 ')
 
Index: refpolicy-2.20261022/policy/modules/roles/sysadm.te
===================================================================
--- refpolicy-2.20261022.orig/policy/modules/roles/sysadm.te
+++ refpolicy-2.20261022/policy/modules/roles/sysadm.te
@@ -853,6 +853,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	postfixpolicyd_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	postgrey_admin(sysadm_t, sysadm_r)
 ')
 
