Exim Sender Rewrite Scheme (SRS): Fixing SPF Forwarding Breaks in cPanel

Email forwarding is one of the most widely used features in web hosting. Businesses and executives in Pakistan frequently set up forwarders like [email protected] forwarding to personal or corporate Google Workspace (@gmail.com) or Microsoft 365 accounts.

However, standard email forwarding completely breaks the fundamental security architecture of Sender Policy Framework (SPF). When an external sender (e.g., [email protected]) sends an email to [email protected], and your cPanel mail server forwards that message to Gmail, Gmail sees your cPanel server’s IP address transmitting an email claiming to be from bank.com.

Because your cPanel server’s IP address is not listed in bank.com’s SPF record, the forwarded email evaluates to SPF: Fail. With major mailbox providers enforcing strict DMARC rejection policies (p=reject), legitimate business inquiries, leads, and transaction alerts are silently dropped or sent directly into the Spam folder!

The engineering solution to this protocol limitation is Sender Rewrite Scheme (SRS). This guide provides a detailed technical breakdown of how SRS works, how to configure and tune native SRS in Exim on cPanel/WHM, and how to verify envelope address rewrites.

---

1. Why Email Forwarding Breaks SPF and DMARC

To understand why SRS is indispensable, examine the envelope sender vs. the visible “From” header during a standard forwarding chain:

Standard Email Forwarding (Breaks SPF):
1. Alice ([email protected]) ──► sends email to [email protected]
   - Envelope Sender: [email protected]
   - Connecting IP: 198.51.100.1 (Authorized in bank.com SPF: PASS)

2. cPanel Server (company.pk - IP 203.0.113.50) forwards email to [email protected]
   - Envelope Sender: [email protected] (Unchanged!)
   - Connecting IP: 203.0.113.50 (NOT in bank.com SPF: FAIL!)
   - Result at Gmail: 550 5.7.26 SPF check failed. Message Rejected!

SPF checks inspect only the Return-Path (the SMTP envelope MAIL FROM: address), not the friendly From: header shown to human recipients. When your server forwards the email without modifying the envelope sender, it assumes identity of the original sender while connecting from an unauthorized IP.

Forwarding with Sender Rewrite Scheme (SRS - SPF Passes!):
1. Alice ([email protected]) ──► sends email to [email protected]
2. cPanel Server rewrites Return-Path using SRS cryptographic hash:
   - Rewritten Sender: [email protected]
   - Connecting IP: 203.0.113.50
   - Result at Gmail: Evaluates SPF against company.pk (which includes 203.0.113.50)!
   - Outcome: SPF PASS! Message delivered to Primary Inbox.

If Gmail rejects the message (e.g., due to user mailbox quota), the bounce email travels back to company.pk, which decrypts the SRS hash and safely returns the bounce notification to Alice at bank.com.

---

2. Enabling Native SRS in cPanel / WHM

Starting with cPanel & WHM version 64+, native support for SRS is integrated directly into the Exim mail transport engine via libsrs2.

Step 1: Enable SRS via WHM Interface

1. Log into WHM as the root administrative user.
2. Navigate to Service Configuration ──► Exim Configuration Manager.
3. Under the Basic Editor tab, locate the Mail section.
4. Locate the setting Sender Rewrite Scheme (SRS).
5. Toggle this option to On.
6. Scroll to the bottom of the page and click Save.

WHM will compile the new Exim configuration directives and restart the Exim mail service.

Step 2: Enable SRS via Terminal Command Line

For automated server provisioning and DevOps playbooks, enable SRS via the cPanel command-line settings API:

# Update Exim configuration settings to activate SRS
whmapi1 set_tweaksetting key=exim_srs value=1

# Rebuild Exim configuration templates and restart service
/usr/local/cpanel/scripts/buildeximconf
systemctl restart exim

Verify that the Exim configuration file includes SRS macros:

grep -i "srs" /etc/exim.conf

You should observe Exim routers utilizing srs_encode and srs_decode transformations.

---

3. Advanced Exim Configuration: Tuning SRS Secret Keys & Max Age

For security, SRS signs each rewritten envelope address with a cryptographic secret key (SRS_SECRET) to prevent third-party spammers from abusing your server as an open bounce relay.

Step 1: Manage Exim SRS Secrets

cPanel automatically provisions a 32-character random secret at /etc/exim.srs.secret. Ensure this file has strict permissions:

# Verify permissions on SRS secret file
ls -la /etc/exim.srs.secret
# File should be owned by mailnull:mail with 0640 permissions:
sudo chown mailnull:mail /etc/exim.srs.secret
sudo chmod 640 /etc/exim.srs.secret

Step 2: Configure SRS Max Age

SRS tokens include a timestamp hash indicating their validity window (typically 21 days). If a bounce arrives after 21 days, Exim drops the bounce to prevent replay attacks.

To adjust SRS parameters, enter the WHM Exim Advanced Editor:

1. Navigate to Exim Configuration Manager ──► Advanced Editor.
2. Locate the ROUTERS CONFIGURATION section.
3. Review the srs_router definition:

srs_router:
  driver = redirect
  senders = ! : ! lsearch;/etc/exim.srs.exclude
  condition = ${if and{ \
    {def:sender_address} \
    {!eq{$sender_address_domain}{$original_domain}} \
    {!eq{$sender_address_domain}{$domain}} \
  }}
  data = ${srs_encode {/etc/exim.srs.secret} {SRS_MAX_AGE} {$sender_address} {$original_domain}}

---

4. Testing & Verifying SRS Rewriting in Exim Logs

To ensure SRS is operating seamlessly and saving your client emails from rejection, test an active forwarding route and inspect the Exim transaction log:

Step 1: Watch Live Exim Transaction Logs

tail -f /var/log/exim_mainlog | grep -E "SRS|forward"

Step 2: Execute an SMTP Test Transaction

Send a test message from an external domain (e.g., [email protected]) to a forwarded address on your server ([email protected]).

Look for the rewritten F= (From envelope) field in /var/log/exim_mainlog:

2026-10-05 18:22:14 1sR9qL-0005dM-4A <= [email protected] H=(mail.example.com) [198.51.100.1] P=esmtps S=2048 [email protected]
2026-10-05 18:22:15 1sR9qL-0005dM-4A => [email protected] <[email protected]> R=dnslookup T=remote_smtp H=gmail-smtp-in.l.google.com [142.250.102.26] X=TLS1.3 C="250 2.0.0 OK" F=<[email protected]>
2026-10-05 18:22:15 1sR9qL-0005dM-4A Completed

Notice the crucial parameter: F=<[email protected]>

Because the envelope sender now belongs to your authorized domain (yourdomain.pk), Google’s inbound MX server verifies your IP address against your domain’s SPF record and records spf=pass.

For corporate mail servers processing millions of transactional notices, e-commerce notifications, and sensitive B2B correspondence across Pakistan, deploying on dedicated hardware ensures isolated clean outbound IP pools. Our Dedicated Servers in Pakistan provide clean IP blocks, rDNS control, and local low-latency routing through the Pakistan Internet Exchange (PKIX).

---

5. Troubleshooting Common SRS Forwarding Errors

Issue 1: “SRS bounce address signature failed verification”

• Cause: The server’s /etc/exim.srs.secret was regenerated while emails were in transit, invalidating earlier SRS bounce tokens.
• Fix: Keep your SRS secret persistent across server migrations or multi-server mail clusters by copying /etc/exim.srs.secret during account transfers.

Issue 2: SRS Bypassed for Specific Transports

• Cause: Third-party anti-spam plugins (such as older versions of MailScanner or custom Exim system filters) can intercept and re-route mail before the srs_router executes.
• Fix: Ensure srs_router is positioned immediately before the smart_host or remote_smtp delivery transports.

---

6. Forwarding Protocols Comparison Matrix

Forwarding Mechanism	SPF Integrity	DMARC Compliance	ARC Preservation	CPU / Overhead
Traditional SMTP Forwarding	Fails (100% of external senders)	Fails on Strict DMARC	None	Low
Sender Rewrite Scheme (SRS)	Passes (100% of external senders)	Neutral / Pass	Preserved	Very Low
Client-Side IMAP Rules (POP/IMAP)	Passes (New message created)	Passes	Not Applicable	High Client Load
SMTP Re-injection / Aliasing	Fails unless re-signed	Fails	Broken	Moderate

For growing digital agencies and IT outsourcing firms managing dozens of client cPanel hosting accounts, our high-spec Cloud VPS instances provide enterprise NVMe storage, dedicated RAM, and automated backup snapshots.

For international platforms coordinating distributed corporate mail clusters and failover smart hosts across Europe and Asia, pairing local nodes with our global Dedicated Servers delivers unmetered bandwidth and carrier-grade transit.

---

Related Mail Server & cPanel Optimization Guides

Advance your mail infrastructure and deliverability expertise:

• Mailcow Dockerized Enterprise Email Server on Linux VPS
• Email Deliverability Masterclass: BIMI, MTA-STS, and TLS Reporting
• cPanel Exim Multi-IP Outbound Rotation and IP Warmup