postalserver / postalserver/postal

SPF not checked for incoming email (missing Envelope-From)

Open
#3,482 5 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Ruby
Stars
16.8k
Forks
1.3k
Avg merge
13d 7h
Merged PRs (30d)
2

Description

## Describe the bug
When an **incoming email** is downloaded from the Postal web panel and then analyzed locally with SpamAssassin using:

```bash
spamassassin -t -D spf < email.eml
```

The SPF plugin does not evaluate the message properly and logs the following debug message:

```
Nov 8 10:57:12.553 [1244] dbg: spf: checking to see if the message has a Received-SPF header that we can use
Nov 8 10:57:12.573 [1244] dbg: spf: using Mail::SPF for SPF checks
Nov 8 10:57:12.573 [1244] dbg: spf: cannot get Envelope-From, cannot use SPF
```

This shows that SpamAssassin is unable to get the **Envelope‑From (Return‑Path)** from the downloaded `.eml` file and as a result the SPF check is skipped.

---

## To Reproduce
1. Receive an incoming email in **Postal**
2. Open the Postal web panel
3. Download the raw message (`.eml` file)
4. Run the command:
```bash
spamassassin -t -D spf < email.eml
```
5. Observe the SPF debug output

---

## Expected behaviour
SpamAssassin should be able to extract or infer the Envelope‑From of the message (e.g. from the `Return‑Path:` header) and perform SPF verification successfully, even when the message is analyzed manually after download.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.