Sieve filter - usage of redirect

EricT

Hello there,
I search to know how “work” Sieve pre/post filter and the impact of mail with redirect.

I have created this rule :

if header :matches "To" "*mail@e.mail*" {
   redirect "external@mail.out";
   setflag "\\seen";
   fileInto "INBOX/subfolder";

If redirect to :

internal mail : work well
external mail :
** hotmail/outlook : rejected
** gmail : error on dkim/dmarc : mail to spam (gmail accept mail if spf is correct)

log of hotmail/outlook :

host outlook-com.olc.protection.outlook.com[52.101.68.14] said: 550 5.7.509
Access denied, sending domain [x.x.x] does not pass DMARC
verification and has a DMARC policy of reject.
[DU2P250MB0286.EURP250.PROD.OUTLOOK.COM 2024-07-04T04:35:45.359Z
08DC9BB71CB06F44] [DU7P250CA0007.EURP250.PROD.OUTLOOK.COM
2024-07-04T04:35:45.365Z 08DC9B99F960F807]
[DB1PEPF000509FC.eurprd03.prod.outlook.com 2024-07-04T04:35:45.374Z
08DC98B844EFF9AF] (in reply to end of DATA command)

on gmail :

DKIM: ‘FAIL’ with domain x.x. Learn more
DMARC: ‘FAIL’ Learn more

After check with Microsoft support, Issue is on my side !
For me, the redirect of rule send mail to external as my mailcow his the original server of the mail : it’s not true !

on the doc :
https://doc.dovecot.org/configuration_manual/sieve/examples/

Forward mails with “order” or “buy” in their subject to another address:

if header :contains “subject” [“order”, “buy”] {
redirect “orders@company.dom”;
}

For me, it’s not a classic forward (or linked to implementation on mailcow?)

I have tested on pre and post filter : same effect :/
I will just auto forward some mail will be enter on the if 🙂

Thank you for any idea !
Eric.

ETNyx

Well, you basically wrote it, your problem is SPF and DKIM. That mean your Mailcow server is not authorized to send, in your case resend, this specific message. Resend is keeping original sender and you are in a manner of speak forging it,…

What to do?

1) Do not resend, and change source straight to final destination.
2) If original sender is in your control, change DNS setting to more relaxed one, there are several points you can modify. Be noted this will most-likely lower your security.
3) Implement SRS on your Mailcow server, this will solve SPF problem, in case of DKIM it depend on setting it may or may not,.. Be noted this is not officially supported by Mailcow.
4) You can try to use notify instead of redirect. If Mailcow support notify using sieve I do not know, but in theory it make new mail that should be in alignment whit Mailcow SPF and DKIM and you bypass your problem.
5) Instead of resend save message to special folder and make possibly cron script to periodically clear and send mail from this folder as new mail.

EricT

Hello @ETNyx
Thank you for your response and explanation !

Yes, i’m not authorized with original sender ! (simple example, I will forward all mail become e-commerce website to a mailbox)

I search to reproduce the same function of “all” email application : forward mail

I read the doc on dovecot and the RFC linked : enotify it’s not recognized on sieve of mailcow (notify yes, miss some dependence to work…). I need to forwark the body of the mail, via notify, it’s not possible… :/

I have a bad workaround :
deploy a mutter on a VM, and scrap mail with params to fwd via mutter :/

I will keep all actions on server if possible !
If not sieve, another possibility ?

Thank you !