Closed rmoesbergen closed 7 years ago
I do not see a way around this, the only recommendation i can think about is to setup split DNS for the domains in question and add the internal addresses to the internal zone.
I'm guessing the SPF_FAIL hit is produced by spamassasin? Isn't there a whitelist option in spamassassin to tell it that the ip's on the relay list are 'trusted', and therefore don't have to go though spf checks?
Guess not... We actually do have a split dns setup (internal vs external), so we could perform the workaround you suggested. Might be good to document this to prevent the same question from others.
Messages sent using baruwa as a relay (smarthost) get an 'SPF_FAIL' spam hit, even though the IP address of the host sending the message is on de relay addresses list for the organization.
How to reproduce:
The workaround in our case is to add the internal host IP to the public SPF record, but that should not be necessary and is a security issue.