I just noticed my postfix setup has been having a problem for some time now.
When receiving (some) mail from German freemail provider web.de, the following headers are found inside the mail postfix passes on to the MDA:
Received: from mout.web.de (unknown) by mail.<mydomain>.de(Postfix 2.9.6/8.13.0) with SMTP id unknown Wed, 29 Jan 2014 09:00:14 +0100 (envelope-from <...@web.de> Received: from 3capp-webde-bs39.server.lan ([172.19.170.39]) by mriweb.server.lan (mriweb002) with ESMTP (Nemesis) id ***** for <...@....de>; Wed, 29 Jan 2014 09:01:01 +0100 Received: from [##.###.##.###] by 3capp-webde-bs39.server.lan with HTTP; Wed Jan 29 09:01:01 CET 2014
This is what's in the logs:
postfix/smtpd: connect from mout.web.de[18.104.22.168] postfix/smtpd: 5C17E14C10A6: client=mout.web.de[22.214.171.124] postfix/cleanup: 5C17E14C10A6: message-id=<trinity-b7f12c80-a158-43f9-8266-583a7b0533bd-############@3capp-webde-bs39> postfix/qmgr: 5C17E14C10A6: from=<...@web.de>, size=6402, nrcpt=1 (queue active) postfix/smtpd: disconnect from mout.web.de[126.96.36.199] postfix/lmtp: 5C17E14C10A6: to=<...@....de>, relay=mail.<mydomain>.de[private/dovecot-lmtp], delay=1, delays=0.81/0/0/0.22, dsn=2.0.0, status=sent (250 2.0.0 <...@....de> qO51H+K06FKAPwAAsCbVSQ Saved) postfix/qmgr: 5C17E14C10A6: removed
The problem is that spamassassin now tries to do RBL checks on the first hop IP, because the IP address from last hop isn't available and the second one is a private network. First hop is of course dynamic, so all mail gets marked as spam.
When trying to reproduce this from my own web.de account the lines look like:
Received: from mout.web.de (mout.web.de [188.8.131.52]) by mail.<mydomain>.de (Postfix) with ESMTP id *** for <info@....de>; Sat, 8 Feb 2014 17:26:11 +0100 (CET)
This is exactly the outcome I expect.
Any clues as to why postfix doesn't put the client IP in the Received header?
Thanks for any help!