Hello,
Trusted Senders is designed to allow you to skip SPAM checks for specified email address and domains. This is skipped in 2 cases. DKIM and SPF are still checked to protect your system,
Trusted Senders
Domain Administrators can add specific email addresses (such as jsmith@example.com) or domains (such as example.com) that will be exempted from spam filtering. This can prevent mail from friends, business associates and mailing lists from being blocked and lets the system know that these messages come from a trusted source. Note: Email addresses in a user's contacts are always considered trusted senders. In addition, if users unmark a message as spam, the sender is automatically included on their personal trusted senders list.
Here is an article that has a more robust description of why SPF and DKIM are exempt from the Trusted Senders.
When the DKIM and SPF both pass the SPAM weight is zeroed out for "Trusted Senders". The header for this looks like this.
X-SmarterMail-Spam: SPF_Pass, HostKarma - Whitelist, Reverse DNS Lookup [Passed], ISpamAssassin 0 [raw: 0], DK_Pass, DKIM_Pass
X-SmarterMail-TotalSpamWeight: 0 (Trusted Sender - Domain)
When either the SPF and/or DKIM fail then the full spam weight of all failed checks are brought forward and passed on. This header will have a line like this.
X-SmarterMail-Spam: SPF_SoftFail, Reverse DNS Lookup [Passed], ISpamAssassin 7 [raw: 5], DK_None, DKIM_None
X-SmarterMail-TotalSpamWeight: 19 (Trusted Sender - User, failed SPF)
There is a workaround that can be used. This may open up your server depending on the IP address that is giving the issue. The first step is to get the IP address that is triggering the SPF / DKIM failure. This can be found in 2 places. The first place to look is in the header of the email. Look for the first "Received: from" line
Return-Path: <user@domain.tld>
Received: from localhost (domain.tld [127.0.0.1]) by mail.domain.tld with SMTP
(version=TLS\Tls12
cipher=Aes256 bits=256);
Received: by localhost (Postfix, from userid 33)
id 3710522744; Wed, 7 Aug 2019 03:49:49 -0400 (EDT)
To: user@domain.tld
Subject: SUBJECT_HERE
From: "User" <user@domain.tld>
Reply-To: user@domain.tld
Content-Type: text/plain; charset=utf-8
Message-Id: <20190807074949.3710522744@localhost>
Date: Wed, 7 Aug 2019 03:49:49 -0400 (EDT)
X-SmarterMail-Spam: SPF_SoftFail, Reverse DNS Lookup [Passed], ISpamAssassin 7 [raw: 5], DK_None, DKIM_None
X-SmarterMail-TotalSpamWeight: 19 (Trusted Sender - User, failed SPF)
If there is more than one "Received: from" line you can ten check the "Spam Checks" log on the server . This log will need to be set to "Detailed" before the email hits the server to use it. In the logs you will want to look for the below lines.
[2019.08.07] 10:31:54.019 [20573] Running SPF check
[2019.08.07] 10:31:54.066 [20573] SPF Fail. IP: 134.209.32.16, Sender: bounce@webpronews.com, FailReason: Not Permitted
[2019.08.07] SPF Record: v=spf1 mx ip4:66.28.139.0/24 ip4:38.103.22.0/24 ip4:159.0.0.0/8 ip4:165.0.0.0/8 a:webpronews.com -all
[2019.08.07] 10:31:54.066 [20573] Finished SPF check; result = Fail
The number in brackets [ ##### ] is the session ID number and the IP address is the IP being tested.
Thank you