Incoming messages are rejected by SPF while using an anti-spam server: REJECT during call 'spf' handler

Symptoms

• Domain example.com is configured to receive messages through an anti-spam server (local one or an external one, e.g. SpamExperts solution)

• Some messages are rejected because of the SPF filter as shown in /var/log/maillog:

  CONFIG_TEXT: May 9 06:17:35 mail-01 /usr/lib64/plesk-9.0/psa-pc-remote[23076]: handlers_stderr: REJECT
  May 9 06:17:35 mail-01 /usr/lib64/plesk-9.0/psa-pc-remote[23076]: REJECT during call 'spf' handler
  May 9 06:17:35 mail-01 postfix/cleanup[8479]: 237388036910C: milter-reject: END-OF-MESSAGE from filter.antispamserver.tld[203.0.113.2]: 5.7.1 Command rejected; from=notification@example.com to=admin@example.com proto=ESMTP helo=<filter.antispamserver.tld>

  ---

  CONFIG_TEXT: Mar 30 10:05:25 web101 postfix/smtpd[31935]: disconnect from filter.antispamserver.tld[203.0.113.2] ehlo=2 starttls=1 mail=1 rcpt=1 bdat=3 quit=1 commands=9
  Mar 30 10:05:25 web101 dk_check[5484]: Starting the dk_check filter...
  Mar 30 10:05:25 web101 dk_check[5484]: DKIM verification (d=sender.tld, 1024-bit key) succeeded
  Mar 30 10:05:25 web101 postfix-local[5483]: PASS during call 'dd52-domainkeys' handler
  Mar 30 10:05:25 web101 dmarc[5485]: Starting the dmarc filter...
  Mar 30 10:05:25 web101 dmarc[5485]: Store DKIM result for 'sender.tld' into DMARC library.
  Mar 30 10:05:25 web101 dmarc[5485]: DMARC: smtpdomain=sender.tld maildomain=sender.tld mailfrom=externaluser@sender.tld stamp=1617091525 ip=2 adkim=relaxed aspf=relaxed p=REJECT sp=NONE pct=100 align_dkim=fail align_spf=fail spfres=fail dkimres=pass dmarccheck=DMARC_POLICY_REJECT dmarcstatus=STOP
  Mar 30 10:05:25 web101 dmarc[5485]: DMARC: REJECT message for johndoe@example.com

Cause

Incoming message goes through the anti-spam server. Because of this, the sender's IP changes and now it does not match the sender's domain SPF record.

Resolution

Configure SPF local rules in Tools & Settings > Mail Server Settings > SPF local rules. The exact set of rules will vary depending on a specific configuration:

Note: the examples below use placeholders. Make sure to replace them with actual values from the real environment