> On Jun 19, 2017, at 4:02 PM, Kevin A. McGrail <kevin.mcgr...@mcgrail.com> > wrote: > > On 6/19/2017 3:27 PM, Robert Kudyba wrote: >> >> Well this user has his sendmail account from our subdomain forward to his >> university Gmail account so that’s where the SPF kicks in. But how come >> those first IPs in the mail header pass? > > I don't know, it's hard to tell with a forwarded email.
Does the logs help? Jun 17 15:53:32 storm sendmail[30146]: v5HJqkrB030146: from=<le...@cis.fordham.edu>, size=1019, class=0, nrcpts=1, msgid=<857f17b790446b08d4d19827b3e51...@cis.fordham.edu>, bodytype=8BITMIME, proto=ESMTP, daemon=MTA, relay=oi66.grupocartonpa ck.com [189.30.23.66] Jun 17 15:53:32 storm sendmail[30146]: v5HJqkrB030146: Milter insert (1): header: X-Virus-Scanned: clamav-milter 0.99.2 at storm.cis.fordham.edu Jun 17 15:53:32 storm sendmail[30146]: v5HJqkrB030146: Milter insert (1): header: X-Virus-Status: Clean Jun 17 15:53:32 storm spamd[2840]: spamd: connection from localhost [::1]:59804 to port 783, fd 5 Jun 17 15:53:32 storm spamd[2840]: spamd: using default config for root: /home/spamd/user_prefs Jun 17 15:53:32 storm spamd[2840]: spamd: processing message <857f17b790446b08d4d19827b3e51...@cis.fordham.edu> for root:1001 Jun 17 15:53:37 storm sendmail[30355]: STARTTLS=client, relay=aspmx.l.google.com., version=TLSv1.2, verify=FAIL, cipher=ECDHE-RSA-AES128-GCM-SHA256, bits=128/128 Jun 17 15:53:38 storm sendmail[30197]: v5HJr7gx030197: unassigned.nodeoutlet.com [103.208.244.235] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Jun 17 15:53:38 storm sendmail[30196]: v5HJr7qA030196: unassigned.nodeoutlet.com [103.208.244.235] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Jun 17 15:53:38 storm sendmail[30195]: v5HJr7K1030195: unassigned.nodeoutlet.com [103.208.244.235] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Jun 17 15:53:47 storm spamd[2840]: spamd: clean message (0.2/5.0) for root:1001 in 15.0 seconds, 1429 bytes. Jun 17 15:53:47 storm spamd[2840]: spamd: result: . 0 - BAYES_00,FROM_IS_TO,PYZOR_CHECK,RCVD_NUMERIC_HELO,T_SPF_HELO_TEMPERROR,T_SPF_TEMPERROR scantime=15.0,size=1429,user=root,uid=1001,required_score=5.0,rhost=localhost,raddr=::1,rport=59804,mid=<857f17b790446b08d4d19827b3e51...@cis.fordham.edu>,bayes=0.001885,autolearn=no autolearn_force=no Jun 17 15:53:47 storm sendmail[30146]: v5HJqkrB030146: Milter add: header: X-Spam-Status: No, score=0.2 required=5.0 tests=BAYES_00,FROM_IS_TO,\n\tPYZOR_CHECK,RCVD_NUMERIC_HELO,T_SPF_HELO_TEMPERROR,T_SPF_TEMPERROR\n\tautolearn=no autolearn_force=no version=3.4.1 Jun 17 15:53:47 storm sendmail[30146]: v5HJqkrB030146: Milter add: header: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on\n\tstorm.cis.fordham.edu Jun 17 15:55:08 storm sendmail[30476]: v5HJqkrB030146: to=<le...@cis.fordham.edu>, ctladdr=<le...@cis.fordham.edu> (15746/1500), delay=00:01:36, xdelay=00:01:21, mailer=local, pri=31610, dsn=2.0.0, stat=Sent Jun
