[GH-ISSUE #275] Sending from alias does not work when sending from same postfix/rspam as anonaddy instance #800

Closed
opened 2026-03-14 10:39:54 +03:00 by kerem · 10 comments
Owner

Originally created by @returntoreality on GitHub (Mar 7, 2022).
Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/275

Anonaddy requires DMARC_POLICY_ALLOW, which is not generated in rspamd for local or authenticated senders since SPF is not checked. This means that local or authenticated sender cannot send via their aliases. As a workaround I changed the line in milter_headers.conf to if (task:has_symbol('DMARC_POLICY_ALLOW') or task:has_symbol('DKIM_SIGNED')) then. This whitelists any locally DKIM signed domains as well.

Originally created by @returntoreality on GitHub (Mar 7, 2022). Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/275 Anonaddy requires DMARC_POLICY_ALLOW, which is not generated in rspamd for local or authenticated senders since SPF is not checked. This means that local or authenticated sender cannot send via their aliases. As a workaround I changed the line in milter_headers.conf to `if (task:has_symbol('DMARC_POLICY_ALLOW') or task:has_symbol('DKIM_SIGNED')) then`. This whitelists any locally DKIM signed domains as well.
kerem closed this issue 2026-03-14 10:40:00 +03:00
Author
Owner

@makua104 commented on GitHub (Mar 11, 2022):

Can you provide more information and an example of what you're trying to do?

<!-- gh-comment-id:1064873024 --> @makua104 commented on GitHub (Mar 11, 2022): Can you provide more information and an example of what you're trying to do?
Author
Owner

@returntoreality commented on GitHub (Mar 11, 2022):

My setup is the following:
I have a mailserver for the maildomain.net and I send mail for a.maildomain.net to annonaddy. The annonaddy user register with their maildomain.net email and can then use a.maildomain.net to receive mails for aliases. What does not work is sending from an alias using the "Send From" feature where you get a destination address like myalias+destinaton=destinationdomain.net@a.maildomain.net. When trying to send an email to this address, the user gets an email "Someone tried to send mails from your alias" (or something along those lines). Since sending from an alias requires a valid DMARC and the policy needs to allow this sender. The problem is, that the check for a valid DMARC policy in rspam requires that both SPF and DKIM were checked (which is what you would want). When receiving emails directly from an authenticated user, the SPF check is not done (which is also what you would want) and in turn the DMARC policy is not checked. And because the header for dmarc-policy-allow is then not set by rspamd, anonaddy rejects the forwarding.

<!-- gh-comment-id:1064911763 --> @returntoreality commented on GitHub (Mar 11, 2022): My setup is the following: I have a mailserver for the maildomain.net and I send mail for a.maildomain.net to annonaddy. The annonaddy user register with their maildomain.net email and can then use a.maildomain.net to receive mails for aliases. What does not work is sending from an alias using the "Send From" feature where you get a destination address like myalias+destinaton=destinationdomain.net@a.maildomain.net. When trying to send an email to this address, the user gets an email "Someone tried to send mails from your alias" (or something along those lines). Since sending from an alias requires a valid DMARC and the policy needs to allow this sender. The problem is, that the check for a valid DMARC policy in rspam requires that both SPF and DKIM were checked (which is what you would want). When receiving emails directly from an authenticated user, the SPF check is not done (which is also what you would want) and in turn the DMARC policy is not checked. And because the header for dmarc-policy-allow is then not set by rspamd, anonaddy rejects the forwarding.
Author
Owner

@makua104 commented on GitHub (Mar 11, 2022):

To make sure I understand:

  • The domain you used in place of example.com in the SELF-HOSTING guide is a.maildomain.net
  • You get an error when trying to send from an alias with this domain e.g. myalias+destinaton=destinationdomain.net@a.maildomain.net
  • This error takes the form of AnonAddy spoof warning email Someone tried to send mails from your alias

Is this correct?

<!-- gh-comment-id:1064931386 --> @makua104 commented on GitHub (Mar 11, 2022): To make sure I understand: - The domain you used in place of `example.com` in the SELF-HOSTING guide is `a.maildomain.net` - You get an error when trying to send from an alias with this domain e.g. `myalias+destinaton=destinationdomain.net@a.maildomain.net` - This error takes the form of AnonAddy spoof warning email `Someone tried to send mails from your alias` Is this correct?
Author
Owner

@returntoreality commented on GitHub (Mar 11, 2022):

Correct

<!-- gh-comment-id:1064934175 --> @returntoreality commented on GitHub (Mar 11, 2022): Correct
Author
Owner

@makua104 commented on GitHub (Mar 11, 2022):

Okay a few more questions:

  • Did you recently upgrade from OpenDKIM and OpenDMARC to Rspamd?
  • Where is the email to myalias+destinaton=destinationdomain.net@a.maildomain.net being sent from?
<!-- gh-comment-id:1064944672 --> @makua104 commented on GitHub (Mar 11, 2022): Okay a few more questions: - Did you recently upgrade from OpenDKIM and OpenDMARC to Rspamd? - Where is the email to `myalias+destinaton=destinationdomain.net@a.maildomain.net` being sent from?
Author
Owner

@willbrowningme commented on GitHub (Mar 11, 2022):

Are you self-hosting AnonAddy or talking about the hosted app.anonaddy.com?

<!-- gh-comment-id:1064948351 --> @willbrowningme commented on GitHub (Mar 11, 2022): Are you self-hosting AnonAddy or talking about the hosted app.anonaddy.com?
Author
Owner

@returntoreality commented on GitHub (Mar 12, 2022):

Did you recently upgrade from OpenDKIM and OpenDMARC to Rspamd?
no, only used rspam so far
Where is the email to myalias+destinaton=destinationdomain.net@a.maildomain.net being sent from?
Using submission/SMTP with authentication to the same postfix that also handles the annonaddy mails
Are you self-hosting AnonAddy or talking about the hosted app.anonaddy.com?
This is a salf-hosted instance

<!-- gh-comment-id:1065876693 --> @returntoreality commented on GitHub (Mar 12, 2022): > Did you recently upgrade from OpenDKIM and OpenDMARC to Rspamd? no, only used rspam so far > Where is the email to myalias+destinaton=destinationdomain.net@a.maildomain.net being sent from? Using submission/SMTP with authentication to the same postfix that also handles the annonaddy mails > Are you self-hosting AnonAddy or talking about the hosted app.anonaddy.com? This is a salf-hosted instance
Author
Owner

@willbrowningme commented on GitHub (Mar 14, 2022):

@returntoreality thanks for the info, I didn't anticipate people would be sending from the same mail server as an authenticated user. I'll look into updating the docs and config to allow for that.

<!-- gh-comment-id:1066667565 --> @willbrowningme commented on GitHub (Mar 14, 2022): @returntoreality thanks for the info, I didn't anticipate people would be sending from the same mail server as an authenticated user. I'll look into updating the docs and config to allow for that.
Author
Owner

@willbrowningme commented on GitHub (Aug 24, 2023):

Is this still an issue?

<!-- gh-comment-id:1691832431 --> @willbrowningme commented on GitHub (Aug 24, 2023): Is this still an issue?
Author
Owner

@ilyadel commented on GitHub (Mar 25, 2024):

Is this still an issue?

I have this issue on my fresh selfhosted instance (docker last release 1.0.9)

Edit : finally, I'm not sure that's I had the same issue, I was able to solve mine by changing MAIL_FROM_ADDRESS= on my addy.env to an address other than the one I use as "recipient" (I can't explain what happened exactly).

<!-- gh-comment-id:2018994093 --> @ilyadel commented on GitHub (Mar 25, 2024): > Is this still an issue? I have this issue on my fresh selfhosted instance (docker last release 1.0.9) Edit : finally, I'm not sure that's I had the same issue, I was able to solve mine by changing MAIL_FROM_ADDRESS= on my addy.env to an address other than the one I use as "recipient" (I can't explain what happened exactly).
Sign in to join this conversation.
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/anonaddy#800
No description provided.