On Sun, Apr 16, 2023 at 07:11:51PM +0100, Sebastian Arcus via Exim-users wrote:
> One thing I have to try and figure out is how Spamassassin does the
> SPF checks. Does it look at all the Received: headers, and if at
> least one of them matches one of the SPF records, then it's all
> fine? Because if that's how it works, SA checks should pass even if
> done on the back-end Exim server.
I don't think it would work by default. SA has a concept of "trusted"
Received headers (because, of course, in general spammers can and do
forge headers) and by default only the first is trusted, ie. the one
added by the MTA that ultimately called SA. I think there is a way to
tweak the trusted setting, but
- configuration of SA is complex (though not as much as exim, lol)
- I don't know if that would actually change the SPF result.
