CLIENT not working behind Proxmox DNAT - PMG still shows internal IP instead of real sender IP

[Al Bakk]

Hello,

I have the following setup:
Infrastructure:

• Old mail server: Postfix 3.4.23 on a separate Hetzner server (X.X.X.X / mail.example.de)
• Proxmox Host: A.A.A.A with DNAT rule (port 25 → 10.0.0.4)
• PMG VM: internal IP 10.0.0.4

Mail flow:

Internet → Old mail server (X.X.X.X)
→ PMG (A.A.A.A) via DNAT
→ Proxmox forwards to 10.0.0.4
→ PMG sees: connect from unknown[10.0.0.1]

What I configured:

On PMG (/etc/pmg/templates/main.cf.in):
smtpd_authorized_xclient_hosts = 10.0.0.1
On old mail server (/etc/postfix/main.cf):
smtp_send_xforward_command = yes

Problem:
PMG still shows connect from unknown[10.0.0.1] instead of the real sender IP. SPF checks are failing because PMG checks SPF against 10.0.0.1 instead of the real sender IP.
PMG does offer XCLIENT in EHLO response:
250-XCLIENT NAME ADDR PROTO HELO REVERSE_NAME PORT LOGIN DESTADDR DESTPORT

Question:
Is XCLIENT possible in this setup where Proxmox DNAT is between the old mail server and PMG? If yes, what is the correct configuration?
Thank you in advance!