From: Vsevolod Stakhov <vsevolod@rspamd.com>
Date: Thu, 16 Jul 2026 09:02:27 +0000 (+0100)
Subject: [Fix] SPF: check the original envelope sender
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=988e8e88fdbbb67e5d2d39b759b161914b6db477;p=thirdparty%2Frspamd.git

[Fix] SPF: check the original envelope sender

SPF evaluates the RFC5321.MailFrom as it was transmitted (including
local-part macros), so resolve the SPF record and credentials from the
original envelope sender even if the envelope from has been rewritten,
e.g. by the aliases module.

Issue: #6137
---

diff --git a/src/libserver/spf.c b/src/libserver/spf.c
index 2beec32fdb..c06aae27c9 100644
--- a/src/libserver/spf.c
+++ b/src/libserver/spf.c
@@ -2670,7 +2670,11 @@ rspamd_spf_cache_domain(struct rspamd_task *task)
 	struct rspamd_email_address *addr;
 	struct rspamd_spf_cred *cred = NULL;
 
-	addr = rspamd_task_get_sender(task);
+	/*
+	 * SPF checks the RFC5321.MailFrom as it was transmitted, so use the
+	 * original sender even if the envelope from has been rewritten
+	 */
+	addr = rspamd_task_get_original_sender(task);
 	if (!addr || (addr->flags & RSPAMD_EMAIL_ADDR_EMPTY)) {
 		/* Get domain from helo */
 
diff --git a/src/libserver/task.c b/src/libserver/task.c
index 31953cf16a..28ee5f693a 100644
--- a/src/libserver/task.c
+++ b/src/libserver/task.c
@@ -954,6 +954,16 @@ rspamd_task_get_sender(struct rspamd_task *task)
 	return task->from_envelope;
 }
 
+struct rspamd_email_address *
+rspamd_task_get_original_sender(struct rspamd_task *task)
+{
+	if (task->from_envelope_orig) {
+		return task->from_envelope_orig;
+	}
+
+	return task->from_envelope;
+}
+
 static const char *
 rspamd_task_cache_principal_recipient(struct rspamd_task *task,
 									  const char *rcpt, gsize len)
diff --git a/src/libserver/task.h b/src/libserver/task.h
index 8225e6293a..e189ae4103 100644
--- a/src/libserver/task.h
+++ b/src/libserver/task.h
@@ -280,6 +280,14 @@ gboolean rspamd_task_process(struct rspamd_task *task, unsigned int stages);
  */
 struct rspamd_email_address *rspamd_task_get_sender(struct rspamd_task *task);
 
+/**
+ * Return the original (pre-rewrite) envelope sender if the envelope from has
+ * been modified (e.g. by aliases resolution), or the current sender otherwise
+ * @param task
+ * @return
+ */
+struct rspamd_email_address *rspamd_task_get_original_sender(struct rspamd_task *task);
+
 /**
  * Return addresses in the following precedence:
  * - deliver to