Outgoing mail gets SPF_FAIL / KAM_DMARC_QUARANTINE in PMG despite final SPF/DKIM PASS

[admingsi]

Hello,

I have a setup where outbound mail is routed through Proxmox Mail Gateway:

Backend mail server -> PMG -> Internet

PMG is also configured to DKIM-sign outgoing messages.

The problem is that PMG spam analysis for outgoing mail reports:

* SPF_FAIL
* KAM_DMARC_QUARANTINE
* KAM_DMARC_STATUS
* DMARC_QUAR

Example score:

Spam detection results: 5

DMARC_QUAR 0.1
KAM_DMARC_QUARANTINE 4
KAM_DMARC_STATUS 0.01
SPF_FAIL 0.919
SPF_HELO_NONE 0.001

However, the final delivered message is completely valid:

* SPF_PASS
* DKIM_VALID
* DMARC PASS
* Spam score 0.00

Authentication results on the recipient side are correct.

It looks like PMG performs SpamAssassin/SPF/DMARC checks on outbound mail before the final DKIM signing or before the message reaches its final sending context.

So my questions are:

1. Is this expected behavior for outbound filtering in PMG?
2. Is there a recommended way to suppress SPF/DMARC checks for outgoing mail only?
3. Should outbound mail generally bypass SpamAssassin authentication checks?
4. Is there a best practice for PMG setups where PMG itself performs DKIM signing?

I found several similar forum threads mentioning SPF failures on internal relays/outbound scanning, but I would like to understand what the recommended configuration is today.

Thank you.

 

[admingsi]

Additionally, I discovered a rather funny side effect of this setup.

I enabled outbound spam checking in PMG and because of the false SPF/DMARC scoring on outgoing mail, a notification from a postmaster about a message being classified as spam was itself classified as spam again by PMG.

This triggered another notification, which again got flagged, creating a recursive notification loop.

The resulting subject lines started looking like this:

"Notification: Notification: Notification: Notification: ..."

So effectively:

* PMG classified a postmaster spam notification as spam,
* generated another notification,
* then classified its own notification again,
* and repeated the process.

This seems to confirm that outbound SpamAssassin checks are being applied to locally generated/report messages in a way that can create feedback loops when SPF/DMARC checks fail during outbound processing.