postalserver / postalserver/postal
SPF not checked for incoming email (missing Envelope-From)
- Dominant language
- Ruby
- Stars
- 16.8k
- Forks
- 1.3k
- Avg merge
- 13d 7h
- Merged PRs (30d)
- 2
Description
## Describe the bug
When an **incoming email** is downloaded from the Postal web panel and then analyzed locally with SpamAssassin using:
```bash
spamassassin -t -D spf < email.eml
```
The SPF plugin does not evaluate the message properly and logs the following debug message:
```
Nov 8 10:57:12.553 [1244] dbg: spf: checking to see if the message has a Received-SPF header that we can use
Nov 8 10:57:12.573 [1244] dbg: spf: using Mail::SPF for SPF checks
Nov 8 10:57:12.573 [1244] dbg: spf: cannot get Envelope-From, cannot use SPF
```
This shows that SpamAssassin is unable to get the **Envelope‑From (Return‑Path)** from the downloaded `.eml` file and as a result the SPF check is skipped.
---
## To Reproduce
1. Receive an incoming email in **Postal**
2. Open the Postal web panel
3. Download the raw message (`.eml` file)
4. Run the command:
```bash
spamassassin -t -D spf < email.eml
```
5. Observe the SPF debug output
---
## Expected behaviour
SpamAssassin should be able to extract or infer the Envelope‑From of the message (e.g. from the `Return‑Path:` header) and perform SPF verification successfully, even when the message is analyzed manually after download.
Contributor guide
Assessment
This issue has not been assessed yet.