1

I have my domain served by two servers with different IP addresses: one for main website and another for online shop. When a customer places an order, among other things, an email is being sent to an internal email address [email protected]. This email is sent by the server on which the online store resides. However the email is sent to be from the customer's email address, so, for example, if [email protected] places an order, an email will be sent from the online store to [email protected] with details of the order, pretending to be from [email protected].

On my mail server, SpamAssassin rejects these emails though because they fail SPF validation check, specifically, I get error message stating that store.example.com is not allowed to send mail from example.org (this is easy to understand, as my online store will not be included into example.org SPF record).

I am administering example.com on behalf of a client - and the client states that emails from the store need to arrive in this format (i.e. from [email protected] as opposed to a generic [email protected]). How can I configure SpamAssassin (via cPanel or, if necessary via back end) to accept messages delivered by store.example.com?

Improve this question
7
  • "this is easy to understand, as my online store will not be included into otherdomain.com SPF record" Why not?
    – ceejayoz
    Dec 22, 2014 at 15:21
  • 1
    @ceejayoz Because it's the customer's email address, which is not the right address to use.
    – Michael Hampton
    Dec 22, 2014 at 15:23
  • 4
    Your client needs to give up on this "requirement". It's bad practice, and many emails will not be delivered.
    – Michael Hampton
    Dec 22, 2014 at 15:23
  • 1
    @MichaelHampton That's easier said than done, but trying to convince your client is another thing altogether. My problem is that they used to have a VERY old email server that didn't care about SPF at all. The services were recently migrated to newer servers with newer software, so now I have to convince the customer that what used to work for 12 years is really bad. Basically, I have to tell my client "Yes, I know this worked for 12 years, but this is bad and has to change" or it won't work.
    – Aleks G
    Dec 22, 2014 at 17:01
  • 3
    How about adding a Reply-To: header which contains the customer's address, and use [email protected] as the From address? This way most e-mail clients will send replies to the customer's e-mail address instead of [email protected].
    – Tero Kilkanen
    Dec 22, 2014 at 17:06

3 Answers 3

Reset to default
3

Everything turned out to be much simpler than I thought - SpamAssassin had nothing to do with it and the SPF rule rejection was happening on the exim level. I modified the exim configuration to include the IP of our online store server into trusted SMTP list - and everything is now working correctly.

Improve this answer
1

The correct way to solve this is to have the client's address in the From: header of the email, but your address in the SMTP MAIL FROMcommand.

Improve this answer
0

If the client requires emails are sent "from" their domain, then they need to add an SPF record for your services, validating this is as an approved endpoint. The include: mechanism in SPF may be the way to go.

Do you host your own mail services? If so, you likely already have an SPF record. You could encourage your client to add a line such as ?include:store.mydomain.com to their SPF, to allow a "neutral" validation of your domain sending as otherdomain.com. Of course your SPF should be pretty strict, not something like +all. I would recommend using the ip address of your online shop server.

If you are only worried about emails coming into your org, and not passing SPF for external recipients, you can get away with only whitelisting the [email protected] addresses in SpamAssassin. whitelist-from SpamAssassin link. (I am not familiar with this configuration, YMMV.)

If you need to deliver emails to other email domains while impersonating the [email protected] address, you will need to have valid SPF or you will fail checks globally. It sounds like you're providing a service to multiple customers, so I recommend having valid SPF and instructing customers to add the ?include: reference to their SPF records.

Improve this answer
3
  • 1
    The From-address is a customer of the store, as far as I understood the problem.
    – sebix
    Dec 22, 2014 at 16:08
  • @sebix is correct. I can't ask EVERY possible potential customer to add my online store to their SPF.
    – Aleks G
    Dec 22, 2014 at 16:59
  • Ok then. If you are the only intended recipient, you will only need to ignore the SPF fail in SpamAssassin. If the mail sent by your store software needs to deliver to end customers, you are going to have trouble.
    – blaughw
    Dec 22, 2014 at 17:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .