Whitelisting a single IP for SPF

mfj

I would like to whitelist a single IP address for SPF checks.

Reason is that we want to migrate from an old server and as an intermediate step we simply forward all mails from the old server to the new mailcow based server. We would still like to keep the other rspamd checks active.

Apart from fail2ban I could not find any whitelisting settings in the mailcow UI and any attempts to set the IP in the rspamd configuration web UI (e.g. /var/lib/rspamd/spf_whitelist.inc.local) did not succeed as I still get R_SPF_FAIL in rspamd.

Any hints?

diekuh

You need to add it as forwarding host in the mailcow UI. 🙂

mfj

Okay, the setup is now the following:

Host old host: domain.com
IP address old host: x.y.z.w
New host: new.domain.com
Forwarding old host -> new host is done with exim4 with a manualroute and remote_smtp transport.
domain.com has been added to Mailcow UI -> Configuration -> Forwarding Hosts

If I send an email from a public email provider (gmx.net) to my private mail address at user@domain.com I get R_SPF_FAIL for mails when receiving them on new.domain.com and this message in the headers:

spf=fail (new.domain.com: domain of someid@gmx.net does not designate x.y.z.w as permitted sender) smtp.mailfrom=someid@gmx.net

diekuh

Yes, that’s expected. Your old mail system forwards a mail with the envelope from xy@gmx.net. Your old server is not allowed to relay for gmx.

You need to disable the spam check for your trusted (!) forwarder.

diekuh

I added some more excludes for fwd hosts.

Please run an update.

(Edit: mailcow/mailcow-dockerized4881f61)

mfj

Working now, thanks!

diekuh

Nice. 🙂