Question : trusted_networks help

My mailserver sits in the DMZ, so he only has a real IP.

All my clients sit behind the firewall in a non routable 192.168.x.x range.  So (I imagine) when they contact the mailserver, they all seem to be coming from the IP of my firewall (which is doing the NAT).

So my question is this: when I send an email, it's being scanned and I'd like to stop that.  Should I add the IP of the firewall to trusted networks?

Or is there another way (like whitelisting the IP of the firewall, not even sure if you can do that).

Thank you.

Answer : trusted_networks help

A network being 'trusted' does not mean the messages are not scanned. When spamassassin performs checks such as SPF it ignores a header if it comes from a trusted host and looks at the machines which sent the mail to the trusted host instead.

So yes you should add the IP address of the firewall to the trusted networks as long as only mail your users send come via that IP address. If all other general incoming mail comes from other IP addresses you will be fine.

If you want to avoid mail from internal users being scanned then that is something you would configure on the mail server software itself. Alternativly if you dont mind the emails being scanned but just want to make sure they never get classed as spam then you could write a custom rule to add a large negative score to all emails coming via your firewall.