From dudi at kolcore.com  Fri Nov 21 09:28:34 2025
From: dudi at kolcore.com (Dudi Goldenberg)
Date: Fri, 21 Nov 2025 08:28:34 +0000
Subject: originating IP
Message-ID: <DU0PR05MB9678DC73C61F5AE606A33643DAD5A@DU0PR05MB9678.eurprd05.prod.outlook.com>

Hello list,

Running v2.13.0 on Debian 12 behind a mail relay.

All detected SPAM is listed as coming from the internal mail relay address.

Is there a way to show the real originating IP?

TIA & regards,

Dudi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.amavis.org/pipermail/amavis-users/attachments/20251121/6e13bddd/attachment.htm>

From p at sys4.de  Fri Nov 21 09:31:56 2025
From: p at sys4.de (Patrick Ben Koetter)
Date: Fri, 21 Nov 2025 09:31:56 +0100
Subject: originating IP
In-Reply-To: <DU0PR05MB9678DC73C61F5AE606A33643DAD5A@DU0PR05MB9678.eurprd05.prod.outlook.com>
References: <DU0PR05MB9678DC73C61F5AE606A33643DAD5A@DU0PR05MB9678.eurprd05.prod.outlook.com>
Message-ID: <o6fy2lbh3ujxh66zbvbl537ixux2dqg2gvmt5aupvaowc5ddlx@uoddbv5jb6kg>

* Dudi Goldenberg <dudi at kolcore.com>:
> Hello list,
> 
> Running v2.13.0 on Debian 12 behind a mail relay.
> 
> All detected SPAM is listed as coming from the internal mail relay address.
> 
> Is there a way to show the real originating IP?

If you use Postfix read into XFORWARD. It will allow an MTA to forward the
originating towards amavis.

p at rick


-- 
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Schlei?heimer Stra?e 26/MG,80333 M?nchen

Sitz der Gesellschaft: M?nchen, Amtsgericht M?nchen: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein


From uhlar at fantomas.sk  Fri Nov 21 09:46:58 2025
From: uhlar at fantomas.sk (Matus UHLAR - fantomas)
Date: Fri, 21 Nov 2025 09:46:58 +0100
Subject: originating IP
In-Reply-To: <DU0PR05MB9678DC73C61F5AE606A33643DAD5A@DU0PR05MB9678.eurprd05.prod.outlook.com>
References: <DU0PR05MB9678DC73C61F5AE606A33643DAD5A@DU0PR05MB9678.eurprd05.prod.outlook.com>
Message-ID: <aSAnAi3AFMptrIK7@fantomas.sk>

On 21.11.25 08:28, Dudi Goldenberg wrote:
>Running v2.13.0 on Debian 12 behind a mail relay.
>
>All detected SPAM is listed as coming from the internal mail relay address.
>
>Is there a way to show the real originating IP?

- how do you plug amavis into your MTA (and which MTA it is)?

- did you configure trusted_networks and internal_networks in spamassassin 
   local.cf ?

https://cwiki.apache.org/confluence/display/SPAMASSASSIN/TrustPath
https://cwiki.apache.org/confluence/display/SPAMASSASSIN/TrustedRelays
https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html


-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
There's a long-standing bug relating to the x86 architecture that
allows you to install Windows.   -- Matthew D. Fuller

From dudi at kolcore.com  Fri Nov 21 10:00:43 2025
From: dudi at kolcore.com (Dudi Goldenberg)
Date: Fri, 21 Nov 2025 09:00:43 +0000
Subject: originating IP
In-Reply-To: <o6fy2lbh3ujxh66zbvbl537ixux2dqg2gvmt5aupvaowc5ddlx@uoddbv5jb6kg>
References: <DU0PR05MB9678DC73C61F5AE606A33643DAD5A@DU0PR05MB9678.eurprd05.prod.outlook.com>
 <o6fy2lbh3ujxh66zbvbl537ixux2dqg2gvmt5aupvaowc5ddlx@uoddbv5jb6kg>
Message-ID: <DU0PR05MB967815CE675FEA30C34C9C18DAD5A@DU0PR05MB9678.eurprd05.prod.outlook.com>

Will look into XFORWARD, thanks.

D.

-----Original Message-----
From: amavis-users <amavis-users-bounces+dudi=kolcore.com at amavis.org> On Behalf Of Patrick Ben Koetter
Sent: Friday, 21 November, 2025 10:32 AM
To: amavis-users at amavis.org
Subject: Re: originating IP

* Dudi Goldenberg <dudi at kolcore.com>:
> Hello list,
> 
> Running v2.13.0 on Debian 12 behind a mail relay.
> 
> All detected SPAM is listed as coming from the internal mail relay address.
> 
> Is there a way to show the real originating IP?

If you use Postfix read into XFORWARD. It will allow an MTA to forward the originating towards amavis.

p at rick


--
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Schlei?heimer Stra?e 26/MG,80333 M?nchen

Sitz der Gesellschaft: M?nchen, Amtsgericht M?nchen: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein


From dudi at kolcore.com  Fri Nov 21 10:04:05 2025
From: dudi at kolcore.com (Dudi Goldenberg)
Date: Fri, 21 Nov 2025 09:04:05 +0000
Subject: originating IP
In-Reply-To: <aSAnAi3AFMptrIK7@fantomas.sk>
References: <DU0PR05MB9678DC73C61F5AE606A33643DAD5A@DU0PR05MB9678.eurprd05.prod.outlook.com>
 <aSAnAi3AFMptrIK7@fantomas.sk>
Message-ID: <DU0PR05MB9678DA5F8BC4BA81FD4E2F2BDAD5A@DU0PR05MB9678.eurprd05.prod.outlook.com>

Hi,

Amavis is called as post-queue content filter from postfix main.cf.

Trusted and internal networks are properly configured, with the mail relay IP excluded.

Regards,

Dudi

-----Original Message-----
From: amavis-users <amavis-users-bounces+dudi=kolcore.com at amavis.org> On Behalf Of Matus UHLAR - fantomas
Sent: Friday, 21 November, 2025 10:47 AM
To: amavis-users at amavis.org
Subject: Re: originating IP

On 21.11.25 08:28, Dudi Goldenberg wrote:
>Running v2.13.0 on Debian 12 behind a mail relay.
>
>All detected SPAM is listed as coming from the internal mail relay address.
>
>Is there a way to show the real originating IP?

- how do you plug amavis into your MTA (and which MTA it is)?

- did you configure trusted_networks and internal_networks in spamassassin 
   local.cf ?

https://cwiki.apache.org/confluence/display/SPAMASSASSIN/TrustPath
https://cwiki.apache.org/confluence/display/SPAMASSASSIN/TrustedRelays
https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html


-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
There's a long-standing bug relating to the x86 architecture that
allows you to install Windows.   -- Matthew D. Fuller