I already had the Backup MX whitelisted but the option "Bypass IP for spam checks" was not selected!

Hi again echoDreamz

This is not what I want. I want to do the all the SpamChecks on the Primary Server (with better antispam tools)

We use SpamHero on a few domains and SpamHero receives the emails and when they deliver those emails to our Primary Server they maitain the Original Sender IP,  SpamHero does not replace the Original Sender IP.

SmarterMail running as a backup MX will not replace the original sender either, it simply adds to the "received" chain in the email headers. By telling SM to bypass gateway spam checks, it should ignore your backup MX when doing spam checks and move to the next "received" header in the email.

I dont have a way to test/check this as all of our anti-spam checks are done at our primary gateways, not by SM itself.

On Smartermail Help the definition of Bypass IP for Spam Checks is

My interpretation is that the Server will Not check emails that came from the Gateway.

Unfortunatly the Backup MX Replaces the Original Sender IP when it passes the email to the Primary Server, I analised this behavier on several emails logs.

The option may be different now, but there should be a way to bypass the gateway IP when doing spam checks. Maybe someone from ST can chime in.

Note that SM does not replace the IP, it behaves like any other mail server does and adds the IP to the emails received headers, as you should see when viewing the email's raw output, unless something has changed, but this would sort of defeat the purpose of the "received" headers if it replaced them completely.

Here is an exemple :

[2024.01.12] 12:32:54.098 [15710590] Delivery started for xxxxxx@xxxxxxx.pt at 12:32:54

[2024.01.12] 12:33:36.307 [15710590] Added to SpamCheckQueue (1 queued; 0/30 processing)

[2024.01.12] 12:33:36.307 [15710590] [SpamCheckQueue] Begin Processing.

[2024.01.12] 12:33:36.308 [15710590] Blocked Sender Checks started.

[2024.01.12] 12:33:36.309 [15710590] Blocked Sender Checks completed.

[2024.01.12] 12:33:36.324 [15710590] [Cyren Client] Start Scanning Message. Enabled Services: All, MailFrom: xxxxxx@xxxxxxx.pt, SenderIP: 13.69.103.123, MessagePath: Z:\Spool\SubSpool7\115710590.eml

[2024.01.12] 12:33:37.518 [15710590] [Cyren Client] Done Scanning Message. MessagePath: Z:\Spool\SubSpool7\115710590.eml Results AV: Unknown, AS: Unknown, RefID: str=0001.0A702F26.65A131A1.0044,ss=1,re=0.000,recu=0.000,reip=0.000,vtr=str,vl=0,cl=1,cld=1,fgs=0

[2024.01.12] 12:33:39.827 [15710590] Spam Checks started.

[2024.01.12] 12:33:39.828 [15710590] [CyrenIP Client] Done Scanning IP Address. IP Address: 13.69.103.123 Reputation: NoRisk, Score: 66, IPClass: T2

[2024.01.12] 12:33:42.253 [15710590] Finished running spam checks. Time (non-rbls): 2137ms, Time (URIBL/RBLS): 288ms

[2024.01.12] 12:33:42.258 [15710590] Spam Check results: [_DMARC: 0,skipped - DMARC Disabled], [REVERSE DNS LOOKUP: 0,Passed], [NULL SENDER: 0,passed], [_CYREN: 0,Unknown], [_CYRENIP: 0,NORISK], [_MESSAGESNIFFER: 0,code:0], [_INTERNALSPAMASSASSIN: 3,1:5], [_SPAMASSASSIN: 0:0], [_SPF: 30,Fail], [_DKIM: 0,Pass], [UCEPROTECT LEVEL 1: 0], [SPAMCOP: 0], [UCEPROTECT LEVEL 2: 0], [BACKSCATTER: 0], [SURRIEL: 0], [HOSTKARMA: 0], [BARRACUDA: 0], [TRUNCATE: 0], [SEM - BLACK: 0], [SPAMHAUS: 0], [URIBL BLACK: 0], [SEM-URI: 0]

[2024.01.12] 12:33:42.258 [15710590] Spam Checks completed.

[2024.01.12] 12:33:42.591 [15710590] Removed from SpamCheckQueue (0 queued or processing)

[2024.01.12] 12:33:45.356 [15710590] Added to LocalDeliveryQueue (0 queued; 1/100 processing)

[2024.01.12] 12:33:45.356 [15710590] [LocalDeliveryQueue] Begin Processing.

[2024.01.12] 12:33:45.372 [15710590] Starting local delivery to xxxxxx@xxxxxxx.pt

[2024.01.12] 12:33:45.372 [15710590] Process delivery status notification step from local recipient success. Recipient: [xxxxxx@xxxxxxx.pt], Notify: [failure], Delivered: [False], Forwarded: [False], Deleted: True

[2024.01.12] 12:33:45.373 [15710590] Delivery for xxxxxx@xxxxxxx.pt to xxxxxx@xxxxxxx.pt has completed (Deleted) Filter: Spam (Weight: 38), Action (Global Level): Delete

[2024.01.12] 12:33:45.373 [15710590] End delivery to xxxxxx@xxxxxxx.pt (MessageID: <2054406152.152813.1705062729767.xxxxxx@xxxxxxx.pt>)

[2024.01.12] 12:33:45.373 [15710590] Starting local delivery to xxxxxx@xxxxxxx.pt

[2024.01.12] 12:33:45.375 [15710590] Process delivery status notification step from local recipient success. Recipient: [xxxxxx@xxxxxxx.pt], Notify: [failure], Delivered: [False], Forwarded: [False], Deleted: True

[2024.01.12] 12:33:45.375 [15710590] Delivery for xxxxxx@xxxxxxx.pt to xxxxxx@xxxxxxx.pt has completed (Deleted) Filter: Spam (Weight: 38), Action (Global Level): Delete

[2024.01.12] 12:33:45.375 [15710590] End delivery to xxxxxx@xxxxxxx.pt (MessageID: <2054406152.152813.1705062729767.xxxxxx@xxxxxxx.pt>)

Yeah, need to get with SmarterTools (may a ticket), to see which option bypasses the gateway address and mvoes to the next IP in the received headers.

This is an interesting thread...

I'm also planning on setting up a couple of SmarterMail FREEs as MX backups, but this same issue has blocked me.

I found this guide: https://portal.smartertools.com/kb/a3549/configure-smartermail-as-a-backup-mx-server.aspx ,  but unfortunately it is not correct because, as described above, it bypasses all anti-spam checks on the primary server and therefore the anti-spam score is incorrect.

I'm curious to know the solution to this problem, so in my opinion it would be correct for SmarterTools to explain to us how to configure this scenario in the right way.

It should be like two identical servers with a shared mail repository configured with an MX level failover.

Then it would either transverse the one or the other configured the same way and the spam handling would be the same.

The receiving server sees the IP of the sending server for RBL, URIBL, SPF, etc analysis. In the a case of a gateway/backup MX you have to rely upon it to perform the IP based checks as the 'mailbox server' will see its IP and not the original IP that delivered to the gateway/backup MX. 

The only way I can think to permit what the op wants is to either perform an API based delivery between SM backup and primary/mailbox servers and for that to pass the original IP or for SM to add an extra header which is signed that permits the mailbox/server to use that if present for antispam evaluation instead of the IP of the backup mx. Neither feature exists today.

You use the Bypass IP feature to skip certain IP's when doing spam checks such as SPF, in the case where a gateway is between you and the true sender of the email. You will still check SPF it just changes the IP the check uses. It does not skip spam checking for that IP.

Hi again,

I confirm what Matt Petty and echoDreamz said! Many Thanks to both!

The option "Bypass IP for Spam Checks" does the Magic! 

The Original Sender IP is Checked on Maibox Server (Primary)

Our Backup MX IP :     13.69.103.123

Original Sender IP:      158.247.18.34

[2024.01.23] 19:34:16.972 [07512848] [Cyren Client] Start Scanning Message. Enabled Services: All, MailFrom: xxxxxx@xxxxxxxx.pt, SenderIP: 13.69.103.123, MessagePath: Z:\Spool\SubSpool5\207512848.eml

[2024.01.23] 19:34:17.537 [07512848] [Cyren Client] Done Scanning Message. MessagePath: Z:\Spool\SubSpool5\207512848.eml Results AV: Unknown, AS: Unknown, RefID: str=0001.0A702F19.65B014B9.002A:SCFSTAT108288121,ss=1,re=-4.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0

[2024.01.23] 19:34:18.664 [07512848] Spam Checks started.

[2024.01.23] 19:34:18.754 [07512848] [CyrenIP Client] Done Scanning IP Address. IP Address: 158.247.18.34 Reputation: NoRisk, Score: 10, IPClass: R3

[2024.01.23] 19:34:23.650 [07512848] Finished running spam checks. Time (non-rbls): 2713ms, Time (URIBL/RBLS): 2271ms

[2024.01.23] 19:34:23.651 [07512848] Spam Check results: [NULL SENDER: 0,passed], [_DMARC: 0,skipped - DMARC Disabled], [REVERSE DNS LOOKUP: 0,Passed], [_CYREN: 0,Unknown], [_CYRENIP: 0,NORISK], [_MESSAGESNIFFER: 0,code:0], [_INTERNALSPAMASSASSIN: 1,1:2], [_SPAMASSASSIN: -1:-2], [_SPF: 0,Pass], [_DKIM: 0,Pass], [BARRACUDA: 0], [SEM - BLACK: 0], [UCEPROTECT LEVEL 1: 5], [BACKSCATTER: 0], [UCEPROTECT LEVEL 2: 10], [HOSTKARMA: 0], [TRUNCATE: 0], [SPAMHAUS: 0], [SPAMCOP: 0], [SURRIEL: 0], [URIBL BLACK: 0], [SEM-URI: 0]

[2024.01.23] 19:34:23.651 [07512848] Spam Checks completed.

Glad to hear! I could agree that the naming of that field can be a bit confusing. We've got a long standing task to eventually address the confusion of inbound/outbound servers and gateway settings in general.