We are developing a SaaS website application that lets users send invoices to their clients. Ideally, these e-mails should appear to be originating from our customers, so the sender e-mail address domain will not match the reverse IP entry for our server. In effect we would be forging their e-mail address, but of course with their consent.

Will that result in a higher probability of being marked as a spammer / their e-mails being marked as spam?

If yes, how bad is the penalty?

And what about people who have an e-mail address originating form an SPF-enabled domain? I guess it should be the majority of the big e-mail providers.


It will certainly increase the spam score, although by how much will depend on each filter technique and implementation. A bigger problem may be that some systems will simply reject the messages, unless each customer adds an appropriate entry into their SPF record. Without that your system may not be recognised as authorised to send messages for that domain.

| improve this answer | |
  • +1, System I admin, SPF/DK fail (soft or hard) = deliver to /dev/null – Chris S Apr 13 '10 at 21:51
  • 1
    wiki.apache.org/spamassassin/AvoidingFpsForSenders Avoiding Spam Assassin For Senders – hurfdurf Apr 13 '10 at 22:04
  • @hurfdurf, Spamassasin is not the only spam filter in the world. It's often used in combination with others but any half decent spam filtering system will not use that alone, which means even if you do defeat Spamassasin you still have other filters to get through. – John Gardeniers Apr 13 '10 at 23:39

Why not set the envelope sender address to an address you control (customername-invoice-bounces@yourdomain, if you like), and just set the From: line in the headers to the customer's intended sending address?

To 99% of recipients, the email appears to come from your customer, but you get to handle bounces however you please, and avoid falling foul of SPF and similar checks.

| improve this answer | |
  • I don't know about all server implementations, but my systems run Courier, and it checks the HELO/EHLO, Envelope From: and Header From: and evaluates each against the SPF record. – Chris S Apr 13 '10 at 21:55
  • good idea, this approach also seems to work fine on googlemail. – Adrian Grigore Apr 14 '10 at 9:42
  • Chris S, does checking header From: against SPF not screw up mailing lists and forwarding? I suspect if it implements that as a hard check, you get very little mail :-) – James Green Apr 18 '10 at 14:49

My answer would be a conditional No.

If you do not send Emails to Invalid addresses or people who do not want the emails, it is very unlikely that your emails will be considered SPAM.

  1. Take this Email Server Test and implement the recommendations (Ignore Domain Keys as it will be difficult to implement on your envrionment).
  2. Make sure you handle bounces properly and take the Email address off if email bounces.
  3. Make sure you do not send Unsolicited emails through this server.
  4. If your clients are knowledgeable, ask them to add a SPF record for your IP (in addition to their current records).

    You should be ok then.

    As far as reverse DNS goes, most email servers only check for a valid Reverse DNS and do not compare it against From addresses.

| improve this answer | |
  • +1 for the tool. But I have a question regarding SPF: Supposing the client is using yahoo mail and Yahoo is using SPF for their server. Wouldn't that mean that the client can't add my server to his SPF record that the SPF record will considerably increase the spam score of the message? – Adrian Grigore Apr 14 '10 at 9:43
  • Client can always add your IP to SPF record, even if they are using Yahoo! or any other external email services. SPF Record is a TXT record in Client's domain DNS which says which email servers are allowed to send out emails using From address of the domain name. The DNS entries can have your IP in addition to the existing mail servers (say Yahoo!). There is no restriction on that. For details on SPF, pls. see openspf.org – Srikrishnan Chitoor Apr 14 '10 at 12:58

If your email server is set up correctly, there should be little if any penalty. I have only had to manualy whitelist incorrectly configured severs.

  • DNS and RDNS should be correctly setup (mail.example.com > > mail.example.com). If you can dedicate a server or IP this can be in the clients domain.
  • As noted, the client should enable your server in SPF.
  • Your server should greet with its DNS address (mail.example.com).
  • From, Reply-to and Envelope from addresses should all resolve as recipients. At the very least they should use valid domains.

Sender addresses frequently are different from the sending domain. I relay a domain which does not have its own servers with no penalty. SPF is appropriately set up for the domain. Prior to setting up my own server, I relayed via my ISPs servers, again with no penalty.

Alternatively, you could arrange to relay via the clients server.

| improve this answer | |
  • Supposing the client is using yahoo mail and Yahoo is using SPF for their server. Wouldn't that mean that the client can't add my server to his SPF record that the SPF record will considerably increase the spam score of the message? – Adrian Grigore Apr 14 '10 at 9:41
  • I did assume that the client was large enough to have their own domain. If they do, then they should have control of their SPF. If they are using yahoo mail, add a Sender headers using an address on your domain. This should be used as the Mail from address on by the server. – BillThor Apr 17 '10 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.