Mx records point to gmail; postfix mail sent direct from server marked as spam by gmail, yahoo

Question

I have an Ubuntu 14.04 server with postfix installed. However, I have set up the domain MX records to point to a Google apps' configuration, as per Google's instructions.

All works fine using email clients such as Thunderbird, Apple, Gmail om Android.

I would also like to forward system mail, such as cron output, to the gmail account. I have setup /etc/postfix/virtual for this. However, such mail gets marked as spam when it arrives at gmail. Same thing if I send to a Yahoo mail account.

Contents of /etc/postfix/main.cf:

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = example.com
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost, localhost.localdomain, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
message_size_limit = 5120000
mailbox_size_limit = 5120000
recipient_delimiter = +
inet_interfaces = all

# to forward to another domain
virtual_alias_maps = hash:/etc/postfix/virtual
inet_protocols = ipv4

Contents of /etc/postfix/virtual:

root [email protected]
postgres [email protected]

Contents of mail marked as spam by gmail:

Delivered-To: [email protected]
Received: by 2002:aed:2f41:0:0:0:0:0 with SMTP id l59-v6csp1151407qtd;
        Fri, 5 Oct 2018 17:01:30 -0700 (PDT)
X-Google-Smtp-Source: ACcGV634DT4ke7ML+6DR3ZbuM0ejugIaHIVQ0A5hTlmrTZQGXwR7JjeJs48KeoNHV3o6zeeGjrp1
X-Received: by 2002:a50:8e56:: with SMTP id 22-v6mr17250946edx.101.1538784090699;
        Fri, 05 Oct 2018 17:01:30 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1538784090; cv=none;
        d=google.com; s=arc-20160816;
        b=LVJKKOt6I2s8vjwvsViL5b7wbkfbzHlQNGu9spySNuQpj8pDSyOa22qvFMw0hy9AL4
         qx8pOqm4iXiREJ6MK+tLEHQ6f1MehnnbxvKNyMwlpZ3GwKPaXYA3di5RZBeXpYJvqINP
         wppqIUo7IFGSQ4nxsZOABbGalB91piDYlEdUS7mZLTeq2krADoDLy1qZJVp0zXRLCXez
         6pASUh4UZv4MfyPOwXRM8pEkefEEEwj3pwW38luavDba9G9qzYaTS9DRR9zBYqI4NPII
         azKKqgqScaPJ/kj3wFCx7xkQ1Zkt/9qpL1/K09qpQfCBF09SVFrKnj5Jp6EtH+sCwbYx
         BK3Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=date:message-id:subject:to:from;
        bh=N+L1jS190l79xwwSepOlGcofnIXcnMDJmaZWohHFPME=;
        b=MfrDCRJLJYqKIOzGHDeEYD1OYxc/qQoVRALEo8KxIWVig51edIPOvy7eUgYljVUqss
         oUmQHIwgMiIjDIpnzG4qDAKoB9F9bWu0IhB8k900+iK1+ZH7sOKPFLwBHXtQhBp7SxOG
         0OEe5MVSCozsVGnQ6z2MDno/zsrG2uqmDQetL2g3ogCePP9kjzqA0KB2bLnPauktDD2T
         Eljz1nrGyJKcnAlb8JVMPD9DFggLBPpmk1yY8hahTmT91B/CVRMSNKXKRInH/msvJWIM
         0lOKkic1tb7mdmoAsCh+BfCiUtxsLk+ndK7TmOS03NzXvEPE7t0xU6I7G7qzeiiQwOre
         Nnyg==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=neutral (google.com: 198.51.100.123 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Return-Path: <[email protected]>
Received: from example.com ([198.51.100.123])
        by mx.google.com with ESMTP id o20-v6si8540152edr.352.2018.10.05.17.01.30
        for <[email protected]>;
        Fri, 05 Oct 2018 17:01:30 -0700 (PDT)
Received-SPF: neutral (google.com: 198.51.100.123 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=198.51.100.123;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 198.51.100.123 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Received: by example.com (Postfix, from userid 105)
    id 0901860898; Sat,  6 Oct 2018 02:01:20 +0200 (CEST)
From: [email protected] (Cron Daemon)
To: [email protected]
Subject: Cron <postgres@treemapp> /var/lib/postgresql/pg_backup_rotated.sh
Content-Type: text/plain; charset=ANSI_X3.4-1968
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/var/lib/postgresql>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=postgres>
Message-Id: <[email protected]>
Date: Sat,  6 Oct 2018 02:01:20 +0200 (CEST)

*** Message Text ****

How to configure this?

Answer 1

spf=neutral (google.com: 198.51.100.123 is neither permitted nor denied by best guess record for domain of [email protected])

This is where to start: configure an SPF record for your domain.

Configure SPF records to work with G Suite

You can set up an SPF record to prevent spammers from using your domain to send unauthorized emails, also called spoofing. Some mail recipients require SPF. If you don’t add an SPF record for your domain, your messages can be marked as spam or even bounce back.

An SPF record lists the mail servers that are permitted to send email on behalf of your domain. If a message is sent through an unauthorized mail server, it’s reported and can be marked as spam.

Your SPF record would probably be like:

v=spf1 +ip4:198.51.100.123 include:_spf.google.com ~all

If that's not enough, the content might actually look like spam.