Trouble with greylisting, secondary MX and SPF

kwisatz

For a while now, I’ve been wondering why I had so many mails (mostly from mailchimp) quarantined.

I have decided to look into it again and I have found that the reason seems to be that they are:

greylisted by the primary mx, then
accepted by the secondary mx, then
forwarded back to the primary mx

However, the primary mx now runs SPAM checks again and determines (rightfully so) that the sending MTA is not matching SPF records.

Example (I have obfuscated both the primary and secondary MX domains as well as the user’s email):

I realize I can disable Spam filtering for forwarding hosts on the primary mx, but that doesn’t feel like a great solution to me because it means maintaining Spam filters on two hosts and loosing all the bayes data that has already been accumulated on the primary mx.

I’m curious as to how others are solving this.

phoenix

Hey @kwisatz, (apologies for the bump)

Did you find a solution for this?

My primary MX (mailcow) is not accepting email forwarded email form my backup MX (postfix).

I see “Greylisted, please try again later (in reply to end of DATA command))” in mail.log of the backup MX.

kwisatz

No I’m afraid I didn’t dig deeper into this and thus didn’t find any solution or any hint on to how to deal with this.

esackbauer

It does not make sense using MX records with multiple hosts and do spam check only on the primary. Then you have to do it on both. Use a firewall with spam protection in front of Mailcow, and disable it on Mailcow by entering the firewall as forwarding host. Then you are much more flexible.