Stop SMTP proxy from changing sender name

I usually recommend avoiding Transparent with the SMTP Proxy.  If that's not possible, make a DNAT for SMTP traffic coming from that external server - that will capture the traffic before the Proxy can see it (see #2 in Rulz).

Cheers - Bob

Hi Bob. Indeed, creating an exception to the transparent proxy and a DNAT rule is the workaround I've ended up with. This is not very satisfying to me, though, as there are multiple mail-sending services on that remote server, and only one of them is having this annoyance. Yet the exception must be made for the entire server.

Are you quite sure that the DNAT intercepts traffic *before* the transparent proxy? Because in my testing it does not appear to work this way. Before moving to the SMTP proxy, I had a DNAT rule in place to handle incoming Exchange mail delivery. But once I turned on the transparent proxy (and without disabling the DNAT rule), the SMTP proxy log was abuzz with activity.

I have seen you several times in the forums here recommend avoiding using transparent SMTP proxying, but I'm not clear on your reasons for this. In our case it appears to work just fine. Furthermore, if there are any problems there I can simply switch it off and let the DNAT rule take over. I'd like to know if I'm missing something here...

I've never tested the Transparent mode against a DNAT, but I'm absolutely certain that a functional DNAT would trump it.  If your DNAT doesn't capture the traffic, it may be because of #4 in Rulz.

In my experience, there's no reason to use "Transparent" except to prove that a server is indeed attempting to relay through the SMTP Proxy.  If things only work when in that  mode, it indicates that the server wasn't listed correctly in 'Allowed Hosts/Networks' for 'Host-based Relay' on the 'Relaying' tab.

As it is, I worry that you could have an open SMTP relay.

Cheers - Bob

Hey Bob,

It turns out I had "transparent" enabled when it did not have to be, as I already had my servers listed correctly on the Relaying tab. Chalk that up to inexperience. I was also breaking Rulz #4: I had a host object defined for the public IP of my Exchange server, and I was using this in my DNAT rules instead of the interface IP object created by the UTM. I went and cleaned that up.

Once I disabled the "transparent" option, the DNAT rules did indeed trump the proxy. But I'm going to stand by what I said earlier: transparent trumps DNAT. To test, I kept my DNAT rule enabled (the one I created to exempt the one server from the proxy), and re-enabled transparent mode on the proxy. Sure enough, that traffic started going through the proxy and I experienced the same display name change that started this thread. Try it yourself. And it doesn't matter whether I use my own host object or the system-generated address object in the DNAT rules

Thanks, Matthew, for testing that and letting us know about it.  I'll modify #2 in Rulz to reflect this.

Cheers - Bob