[enterprise] SMTP Relay -> Spam SPF Classification

[dennisoderwald]

We have Google Workspace in between and receive all emails that cannot be assigned by Google relayed, but now we have noticed that legitimate emails are ending up in spam. As I see it, this is probably due to the SPF record, which is no longer correct.

In our understanding and opinion, the problem lies here:

domain.com sends directly to our Google Workspace domain.
Stalwart now sees a Google server (209.85.221.69) as the sending IP.
SPF check verifies: “Is this Google IP permitted to send for eu-central-1.amazonses.com?” (as example) → No → SPF fail

The actual issue: SPF breaks during forwarding because Google forwards the email with its own IP but does not adjust the envelope sender (@eu-central-1.amazonses.com).

DKIM/DMARC have survived (DKIM signature remains intact during forwarding), but DMARC policy quarantine from domain.com still takes effect due to SPF fail.

What is the best way to solve this problem in Stalwart?

[mdecimus]

Just to confirm, messages are received from Google and placed in a Stalwart's account Spam folder?
If so, can you share the spam classifier tags?

In any case, DMARC requires that either SPF or DKIM pass so a failed SPF validation should not be an issue as long as there is at least one DKIM signature that passes.

[dennisoderwald]

Just to confirm, messages are received from Google and placed in a Stalwart's account Spam folder?

Yes

If so, can you share the spam classifier tags?

Can I see these in the Stalwart web interface under Received Messages? I have now looked directly in the mail headers.

X-Spam-Result: DMARC_POLICY_ALLOW (-0.50),
	DKIM_ALLOW (-0.20),
	RWL_MAILSPIKE_GOOD (-0.10),
	ARC_ALLOW (0.00),
	ARC_SIGNED (0.00),
	DKIM_SIGNED (0.00),
	DMARC_POLICY_ALLOW_WITH_FAILURES (0.00),
	DNSWL_BLOCKED (0.00),
	DWL_DNSWL_BLOCKED (0.00),
	FROM_NEQ_ENV_FROM (0.00),
	FROM_NO_DN (0.00),
	HAS_ATTACHMENT (0.00),
	HAS_EXTERNAL_IMG (0.00),
	HAS_REPLYTO (0.00),
	HTML_SHORT_3 (0.00),
	PREVIOUSLY_DELIVERED (0.00),
	RBL_SENDERSCORE_REPUT_BLOCKED (0.00),
	RCPT_COUNT_TWO (0.00),
	RCVD_COUNT_TWO (0.00),
	RCVD_TLS_LAST (0.00),
	REPLYTO_DOM_NEQ_FROM_DOM (0.00),
	SOURCE_ASN_15169 (0.00),
	SPF_SOFTFAIL (0.00),
	TO_DN_NONE (0.00),
	TO_MATCH_ENVRCPT_SOME (0.00),
	URIBL_BLOCKED (0.00),
	FORGED_SENDER (0.30),
	FORGED_RCVD_TRAIL (1.00),
	PHISHING (4.00),
	SPOOF_REPLYTO (6.00)
X-Spam-Score: spam, score=10.50

This is an email that came from Amazon Web Services Billing, for example.

[dennisoderwald]

@mdecimus ping :)

[mdecimus]

The issue is not DMARC in this case. The headers have something suspicious in them that makes the spam filter assign a high spam score. Can you share them? Probably it has an envelope from address that does not match the from header.

[MartinTerp]

If stalwart is always behind google and does google handle spam?
If so, then i would just disable spf validation on stalwart