Incoming messages routed through an antispam server are rejected by SPF: REJECT during call 'spf' handler

Symptoms

• The domain uses a local or external antispam server, like SpamExperts.

• Some messages are rejected because of SPF, with this logged to /var/log/maillog

  /usr/lib64/plesk-9.0/psa-pc-remote[23076]: handlers_stderr: REJECT
  /usr/lib64/plesk-9.0/psa-pc-remote[23076]: REJECT during call 'spf' handler
  postfix/cleanup[8479]: 237388036910C: milter-reject: END-OF-MESSAGE from filter.antispamserver.tld[203.0.113.2]: 5.7.1 Command rejected; from=notification@example.com to=admin@example.com proto=ESMTP helo=<filter.antispamserver.tld>

  postfix/smtpd[31935]: disconnect from filter.antispamserver.tld[203.0.113.2] ehlo=2 starttls=1 mail=1 rcpt=1 bdat=3 quit=1 commands=9
  dk_check[5484]: Starting the dk_check filter...
  dk_check[5484]: DKIM verification (d=sender.tld, 1024-bit key) succeeded
  postfix-local[5483]: PASS during call 'dd52-domainkeys' handler
  dmarc[5485]: Starting the dmarc filter...
  dmarc[5485]: Store DKIM result for 'sender.tld' into DMARC library.
  dmarc[5485]: DMARC: smtpdomain=sender.tld maildomain=sender.tld mailfrom=externaluser@sender.tld stamp=1617091525 ip=2 adkim=relaxed aspf=relaxed p=REJECT sp=NONE pct=100 align_dkim=fail align_spf=fail spfres=fail dkimres=pass dmarccheck=DMARC_POLICY_REJECT dmarcstatus=STOP
  dmarc[5485]: DMARC: REJECT message for john.doe@example.com

Cause

The incoming message goes through the antispam server, which changes the sender's IP address. The new IP address doesn't match the domain's SPF record, so the email gets rejected.

Resolution

Configure the local SPF rules in Tools & Settings > Mail Server Settings > SPF local rules correctly. The exact set of rules varies depending on each specific configuration.

Note: The examples below use placeholders. Make sure to replace them with actual values from the real environment.