[Rspamd-Users] Filtering outgoing emails

[Tim Harman]

On 11/05/2019 11:18 am, Philippe Paget wrote:
<<snip snip>>
> Good point Tim, the Wifi was of and I didn't check before sending the
> email. Sorry.
> 
> This time it's correct, here is the headers from a TRUE local 
> connection:
> 
> X-Spamd-Result: default: False [15.60 / 30.00];
>     ARC_NA(0.00)[];
>     RDNS_NONE(1.00)[];
>     ONCE_RECEIVED(0.10)[];
>     TO_EQ_FROM(0.00)[];
>     FROM_HAS_DN(0.00)[];
>     DMARC_POLICY_SOFTFAIL(0.10)[tatm.com : No valid SPF, No valid 
> DKIM,none];
>     TO_MATCH_ENVRCPT_ALL(0.00)[];
>     MIME_GOOD(-0.10)[multipart/alternative,text/plain];
>     ONCE_RECEIVED_STRICT(4.00)[];
>     R_SPF_SOFTFAIL(0.00)[~all];
>     HFILTER_HELO_BADIP(4.50)[192.168.0.112,1];
>     RCPT_COUNT_ONE(0.00)[1];
>     DIRECT_TO_MX(0.00)[K-9 Mail for Android];
>     TO_DN_ALL(0.00)[];
>     VIOLATED_DIRECT_SPF(3.50)[];
>     RCVD_COUNT_ZERO(0.00)[0];
>     RCVD_IN_DNSWL_FAIL(0.00)[13.177.173.37.list.dnswl.org:server fail];
>     R_DKIM_NA(0.00)[];
>     MIME_TRACE(0.00)[0:+,1:+,2:~];
>     ASN(0.00)[asn:51207, ipnet:37.160.0.0/12, country:FR];
>     HFILTER_HOSTNAME_UNKNOWN(2.50)[];
>     MID_RHS_MATCH_FROM(0.00)[];
>     FROM_EQ_ENVFROM(0.00)[]
> 
> 
> According to this page from manual :
> https://rspamd.com/doc/tutorials/scanning_outbound.html
> 
> I have check for the "local_addrs" variable, and 192.168.0.112 should
> be seen as a local IP.
> 
> I don't have setup anything regarding this outbound email problem.
> Maybe Rspamd need more to identify outgoing traffic, but I don't see
> what I could add.
> 
> Regards,
> 
> Phil

I still think there's another hop in here somewhere.

13.177.173.37.list.dnswl.org:server fail

That indicates to me (and maybe I'm wrong) that 37.173.177.13 is the 
host making the connection.
It then ANNOUNCES itself as HFILTER_HELO_BADIP(4.50)[192.168.0.112,1];

Do you have NAT or something going on here?  Can you post the logs of 
your mailserver when it gets the mail from your K9 client?

Tim