Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a mail server "" which forwards all emails with recipient "" to "". My mail server runs Postfix and it uses the virtual_alias_maps mechanism to perform the forwarding. I also have SPF records installed for "":

v=spf1 a ~all

The problem is, whenever someone delivers mail to "", Gmail validates the SPF records against's IP address! I thought it's supposed to validate against the original sender's IP address.

For example, I'm on my laptop on my home Internet connection. I connect to's mail server as follows:

$ telnet 25
20 ESMTP Postfix (Debian/GNU)
HELO my-laptop.local
250 2.1.0 Ok
250 2.1.5 Ok
354 End data with <CR><LF>.<CR><LF>
Subject: test

250 2.0.0 Ok: queued as CE5F42200F9

Now when I open that mail in Gmail and view its source, I see the following headers:

Received: by with SMTP id hv3csp61494ibb;
        Sat, 14 Jul 2012 02:15:58 -0700 (PDT)
Received: by with SMTP id l5mr2360326qct.5.1342257358291;
        Sat, 14 Jul 2012 02:15:58 -0700 (PDT)
Return-Path: <>
        by with ESMTP id u9si4262071qcv.89.2012.;
        Sat, 14 Jul 2012 02:15:58 -0700 (PDT)
Received-SPF: neutral ( [EXAMPLE.COM's IP ADDRESS HERE] is neither permitted nor denied by domain of client-ip=[EXAMPLE.COM's IP ADDRESS HERE];
Authentication-Results:; spf=neutral ( [EXAMPLE.COM's IP ADDRESS HERE] is neither permitted nor denied by domain of
Date: Sat, 14 Jul 2012 02:15:58 -0700 (PDT)
Message-Id: <>
Received: from my-laptop.local ([LAPTOP's IP ADDRESS HERE])
    by (Postfix) with SMTP id CE5F42200F9
    for <>; Sat, 14 Jul 2012 09:15:44 +0000 (UTC)
Subject: test

As you can see in Received-SPF and Authentication-Results, the SPF records are being validated against [EXAMPLE.COM's IP ADDRESS] instead of [LAPTOP's IP ADDRESS].

Why does this happen, and how do I fix this problem?

share|improve this question
This is the correct behavior. There's no point in checking the laptop's IP address -- that wouldn't check if the mail was sent through the correct server. (The laptop's IP address tells you nothing about whether it's user is authorized to use email addresses.) – David Schwartz Jul 14 '12 at 9:31
up vote 10 down vote accepted

google [or anyone else] will validate spf agains the ip address they see connecting to them. in that case it'll be ip address of your postfix server; you cannot fix it - it's by design....

by design spf has an 'issue' with forwarding unless message is 'repackaged' and sender address rewritten to the one of forwarder.

share|improve this answer
How do I set up SRS in Postfix? After a few Google searches I've only found a bunch of 2008 articles that tell me Postfix doesn't support it. – Hongli Lai Jul 14 '12 at 9:49
sorry i know only as much as googling for postfix srs returns. – pQd Jul 14 '12 at 9:55
There is a guide here:… - Although that didn't solve the issue for me – troelskn Aug 20 '13 at 13:55
Correction - It did work. See full details here:… – troelskn Aug 20 '13 at 18:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.