FREEMAIL_FORGED_FROMDOMAIN triggered for plesk internally forwarded mail

[TomBoB]

Username:

TITLE

FREEMAIL_FORGED_FROMDOMAIN triggered for plesk internally forwarded mail

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Plesk 18.0.48, AlmaLinux 8.7

PROBLEM DESCRIPTION

Send an email from Gmail (as an example) to a mailbox on a Plesk server. The receiving email address one@1stdomain.tld (no matter if the mailbox is enabled or not) has forwarding set up to another mail address two@2nddomain.tld of a different domain, but on the same Plesk server.
Lets assume the mailbox for one@1stdomain.tld is enabled. Allows for checking the mail headers.
The gmail mail comes in and the header is all ok. Nothing special special triggers during spam testing.
Check the header of the forwarded email in the mailbox of two@2nddomain.tld
Spam testing now triggers FREEMAIL_FORGED_FROMDOMAIN. Actually as well as HEADER_FROM_DIFFERENT_DOMAINS.
Both are obiously very wrong and should not trigger.
The second trigger is already pointed out here: Forwarded to devs - SPF_FAIL for internally forwarded emails in detail.

EDIT: We use Plesk Email Security, not the "standard" setup, but I believe the same problem happens without PES as well.

STEPS TO REPRODUCE

As described in above problem description.

ACTUAL RESULT

spam testing for forwarded mail from gmail triggers FREEMAIL_FORGED_FROMDOMAIN . [And HEADER_FROM_DIFFERENT_DOMAINS].

EXPECTED RESULT

Don't trigger those. Mail is a genuine gmail one that came in, and is being forwarded to another mail address. Genuine all the way.

ANY ADDITIONAL INFORMATION

(DID NOT ANSWER QUESTION)

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[Kaspar]

I would argue that both are expected and are rather the result of the rule implementation by SpamAssassin. Not by any (wrong) doing on Plesk's side.

The HEADER_FROM_DIFFERENT_DOMAINS rule gets triggered when the From address is different from the envelope sender. As the envelope sender get rewritten on forwarding for the Sender Rewriting Scheme, this rule gets triggered. Similarly for FREEMAIL_FORGED_FROMDOMAIN. It gets triggered because the envelope sender got rewritten.