empty sender in spamreports and DMARC

I

IEM

Active Member
Proxmox Subscriber
Sep 4, 2018
71
11
48
50
Austria
so we have PMG configured to sign all emails with DKIM, and have setup an SPF record and a DMARC record for our outgoing domain.

everything works nicely, except... spamreports generated by proxmox.

at least, spamreports directed at users that have setup a forward to an external domain.

afaict, the problem is as follows:

prequel​
  • our domain is example.com
  • our PMG has the fqdn mailgate.example.com, which resolves to 203.0.113.178; reverse lookup of the IP address yields ip178.example.net (for $reasons); because some mailservers refuse our mails if the HELO does not match the reverse lookup of the IP, the PMG postfix is configured with smtp_helo_name = ip178.example.net
  • user "jane" (with a local email address jane@example.com) has left our company a while ago, and her account has been redacted. as a courtesy, we are forwarding all her emails to her new address jane@example.org by means of `/etc/aliases` on our main mailserver (the server behind the PMG)
  • since the mail address has been around for some time, it receives a bit of spam.
the story​
  1. PMG generates spamreport for the jane@example.com with an empty Return-path/envelope sender (<>), and a From: Proxmox Mail Gateway <postmaster@mailgate.example.com>
  2. the spamreport is sent to our internal mailserver mail.example.com
  3. our mailserver looks up the alias and forwards the mail to jane@example.org via our outgoing mailserver (the PMG)
  4. PMG attempts to add a DKIM-signature for the forwarded mail but fails (presumably because the sender domain is empty)
  5. PMG sends the email
    Code: 
    Feb 02 07:05:29 mailgate pmg-smtp-filter[214493]: 211C1679F0B29A65F4: new mail message-id=<20250202060528.880E821C93@mailgate.example.com>
Feb 02 07:05:29 mailgate pmg-smtp-filter[214493]: 211C1679F0B29A65F4: Could not create DKIM-Signature - disabling Signing: no domain in sender e-mail
Feb 02 07:05:29 mailgate pmg-smtp-filter[214493]: 211C1679F0B29A65F4: accept mail to <jane@example.org.com> (D81F9212CF) (rule: default-accept)
Feb 02 07:05:29 mailgate pmg-smtp-filter[214493]: 211C1679F0B29A65F4: processing time: 0.248 seconds (0, 0.169, 0)
Feb 02 07:05:29 mailgate postfix/smtpd[216347]: proxy-accept: END-OF-MESSAGE: 250 2.5.0 OK (211C1679F0B29A65F4); from=<> to=<jane@example.org> proto=ESMTP helo=<mail.example.com>
  6. the next day I get a DMARC report from the example.org mailserver, claiming that all things went wrong.
    here's an excerpt from the report:
    XML: 
    <record>
  <row>
    <source_ip>203.0.113.178</source_ip>
    <count>1</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>fail</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
  <identifiers>
    <envelope_to>example.org</envelope_to>
    <envelope_from>&lt;&gt;</envelope_from>
    <header_from>mailgate.example.com</header_from>
  </identifiers>
  <auth_results>
    <spf>
      <domain>ip178.example.net</domain>
      <scope>helo</scope>
      <result>none</result>
    </spf>
  </auth_results>
</record>

afaict, the problem is really that the sender address is empty, and therefore
  • the mail cannot be DKIM signed
  • the receiver (presumably example.org) uses the helo name to fill in some defaults domains for both SPF and DKIM, which is plain wrong

so: how can i generate spamreports that pass DKIM/SPF validation even when forwarded to an external domain?
 
Seeing the same issue. No matter if I put a good address in Configuration>Spam Detector>Quarantine>EMail 'From:' or not the log always shows from=<>.
 
You must log in or register to reply here.
Top Bottom
Back