0

I am running a mail server (postfix) on a VPS that is set up to forward all mail sent to an address in my private domain to a GMail address. SPF, SRS, DKIM, and DMARC are set up for my mail server and work fine for most mail, i.e. forwarded mails equipped with SPF, DKIM, and DMARC are delivered into my GMail inbox and the GMail servers report them as passing SPF, DKIM, and DMARC.

There are, however, senders that send mails with only SPF and DMARC, but no DKIM, e.g. deutschepost.de. This particular sender also has a DMARC reject policy implemented which leads to problems: When my server forwards the mail, SRS rewrites its envelope sender, so that SPF still passes when the message arrives at GMail. The rewritten envelope sender, however, leads to failure of DMARC's SPF alignment check, resulting in the message being rejected by GMail.

As I understand from this explanation, this behavior is to be expected. But is there also a way to deal with it on my (i.e. the forwarder's) side?

TL;DR How to forward mails with SPF and DMARC but no DKIM without breaking DMARC?

EDIT: According to Jacob's comment, an option would be to rewrite the From header to my domain. Is it possible to do this with postfix only for mail that have SPF and DMARC, but no DKIM? Because those with DKIM would fail the alignment check after rewriting.

  • 1
    you would need to rewrite the full message header, changing source address included, something like user@domain.com to user+domain+com@mydomain.com otherwise dmarc would not resolve spoofing. ARC is suppose to help resolve this without removing origin information – Jacob Evans Jul 3 '18 at 21:42
  • Thanks Jacob. I have updated my question to include this suggestion. – user3298489 Jul 4 '18 at 4:40
0

What you need to do is use a Sender Rewrite Scheme (SRS). This is not something that is found in PostFix by default, but you could install a Postfix Sender Rewriting Scheme daemon like this one to help with the issue.

You could checkout this post with an admin that has the same issue and uses the same daemon to help with the problem.

  • I am using SRS already to rewrite the envelope sender. Also rewriting the From header would probably solve the forwarding issue, but would break the possibility to reply to forwarded mails (because the mail client shows the rewritten From address). – user3298489 Jul 27 '18 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.