Skip to content

Conversation

@AndrewPaglusch
Copy link
Contributor

When inbound emails contain a "Sender" header, AnonAddy doesn't strip it off when forwarding the email. This causes problems if you've configured the application to relay emails via Amazon SES, since it validates that ALL email headers (From, Sender, and Return-Path) contain only verified identities in your SES account. If any of these headers contain an unverified domain, SES rejects the entire email with an error like:

554 Message rejected: Email address is not verified. The following identities failed the check in region US-WEST-2: no-reply@not-my-domain.com

This change adds a POSTFIX_STRIP_SENDER_HEADER env var (default false), which will optionally configure Postfix to strip off the "Sender" header from emails if present before attempting to relay them.

To enable Sender header stripping, set the environment variable:

POSTFIX_STRIP_SENDER_HEADER=true

Fixes #267
Related: anonaddy/anonaddy#471

@AndrewPaglusch
Copy link
Contributor Author

I've just tested and verified this change works exactly as expected. Thank you to @buxm for providing the exact changes needed to resolve this issue.

Removing draft flag from this PR and opening it up for review..

@AndrewPaglusch AndrewPaglusch marked this pull request as ready for review August 22, 2025 06:05
@AndrewPaglusch
Copy link
Contributor Author

Hey @crazy-max! Just wanted to give this a friendly bump – it's been about 7 weeks since submission. Would love to get your eyes on this when you have a chance. Thanks for all your work on the project!

chmod o= /etc/postfix/mysql-virtual-alias-domains-and-subdomains.cf
chgrp postfix /etc/postfix/mysql-virtual-alias-domains-and-subdomains.cf

if [ "$POSTFIX_STRIP_SENDER_HEADER" = "true" ]; then
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you also add the default value for this env at

POSTFIX_DEBUG=${POSTFIX_DEBUG:-false}
POSTFIX_MESSAGE_SIZE_LIMIT=${POSTFIX_MESSAGE_SIZE_LIMIT:-26214400}
POSTFIX_SMTPD_TLS=${POSTFIX_SMTPD_TLS:-false}
POSTFIX_SMTP_TLS=${POSTFIX_SMTP_TLS:-false}
POSTFIX_RELAYHOST_AUTH_ENABLE=${POSTFIX_RELAYHOST_AUTH_ENABLE:-false}
POSTFIX_RELAYHOST_SSL_ENCRYPTION=${POSTFIX_RELAYHOST_SSL_ENCRYPTION:-false}
#POSTFIX_SPAMHAUS_DQS_KEY=${POSTFIX_SPAMHAUS_DQS_KEY:-null}
#POSTFIX_RELAYHOST_USERNAME=${POSTFIX_RELAYHOST_USERNAME:-null}
#POSTFIX_RELAYHOST_PASSWORD=${POSTFIX_RELAYHOST_PASSWORD:-null}

@willbrowningme
Copy link
Member

Looks good to me, thanks all.

@crazy-max crazy-max merged commit 3ce6ede into anonaddy:master Oct 19, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add variable(s) to strip off headers from forwarded emails (Amazon SES compatibility)

3 participants