On 12/19/21 7:17 PM, John Levine wrote:
They are telling you not to forward their mail. So don't.
The thing that I left out, because I didn't think it mattered, is that
I'm all three parties in this situation, original source, original
destination, and forwarded destination. So ... yes, but no.
I realize their advice may be ill-considered or ignorant, but so be it.
Chuckle.
FWIW I have largely given up on forwarding and tell my users who want
to get their mail somewhere else to set up their other provider to
poll their mailbox here.
Telling myself to poll a different mailbox is ... let's go with a
non-starter.
I realize there is a thing called SRS which is supposed to fix the SPF forwarding problem, but I haven't found it very useful in practice,
since it turn SPF fails into DMARC fails.
I've actually got SRS working with Sendmail and it doesn't make any real difference in this case.
More details on the mail flow are as follows:
1)
gtaylor@domain1.example sends a message to
gtaylor@domain2.example.
2)
gtaylor@domain2.example .forwards to
host2@domain3.example.
gtaylor@domain1.example could just as easily be <something>@gmail.com as
both domain1.example and gmail.com have similar (but not identicle) restrictions.
domain1.example and domain3.example are hosted on the same host. domain2.example uses the same host as the inbound MX from the world and mailertable rotues to the internal host.
So ...
1) Something (
gtaylor@domain1.example / <something>@gmail.com) sends an
email to
gtaylor@domain2.example which relays through the public host on
it's way to the internal host.
2) The internal host receives the email from something to
gtaylor@domain2.example.
3) The internal host .forwards the message to
host2@domain3.example.
4) The public host rejects the message from something
(
gtaylor@domain1.example / <something>@gmail.com) because the message
runs afoul of SPF (-all).
A little more background: I have many systems that .forward messages
from them to special addresses on my main mail server. E.g <REDACTED>@domain2.example .forwards to
domain2@<REDACTED>.domain1.example. This means that systems I have
configured .forward messages from cron and the likes to my central account.
I just started testing something wherein email from the public Internet
was going into my address on one of my hosts, where it dutifully
forwarded to the host's sub-domain address on the main mail server.
Except ... SPF.
Seeing as how I have full control of the leafe systems in question which
are .forwarding to my central account, I am quite content if they
masquerade everything that leaves the system to appear to be from me /
my address on said leafe system.
I could do what I want by enhancing .forward to pipe into a program that
would turn the message into an RFC 822 attachment to a new email. But
that seems ... overkill.
--
Grant. . . .
unix || die
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)