1. The Forwarding SPF Crisis: Why Indirect Mail Breaks Inboxes

To understand why Sender Rewriting Scheme is required, examine a standard email forwarding transaction:

2. SRS Mechanics: Anatomy of SRS0 and SRS1 Address Tokens

The Sender Rewriting Scheme solves this problem by modifying the envelope sender (MAIL FROM) while leaving the visible message From: header untouched (ensuring Bob still sees Alice as the sender in his email client).

First-Hop Rewriting: The SRS0 Token

When the forwarder forwards Alice’s email, it rewrites the envelope return-path from alice@sender.com to an encoded local-part under its own domain (forwarder.org):

SRS0=HHH=TT=sender.com=alice@forwarder.org

• SRS0=: Standard prefix identifying a first-hop rewritten address.
• HHH: A 4-character cryptographic hash (HMAC-SHA1) computed over the timestamp, original domain, original local-part, and a secret server key. This prevents spammers from forging SRS return paths to use your server as an open bounce relay.
• TT: A 2-character timestamp indicating the expiration date (typically 21 days), preventing replay attacks.
• sender.com: The original sending domain.
• alice: The original local-part.
• @forwarder.org: The forwarder’s authoritative domain.

Because the new envelope sender is ...@forwarder.org, Gmail checks the SPF record for forwarder.org against the forwarder’s IP address. The check returns PASS, allowing the email to reach the primary inbox!

Multi-Hop Rewriting: The SRS1 Token

If Bob’s Gmail inbox forwards the message to a third destination (Charlie at Yahoo), a second rewrite occurs without bloating the address, transforming the token into an SRS1 address:

SRS1=HHH=forwarder.org==HHH=TT=sender.com=alice@secondforwarder.com

3. PowerMTA SRS Architecture: Native Pipes vs Lua Hooks

PowerMTA does not compile SRS natively into its core C kernel, but provides two high-performance integration patterns:

1. Native Pipe Delivery to Postfix/pysrs: PowerMTA hands off forwarding streams to a local loopback script or Postfix milter running postsrsd.
2. In-Flight Lua Hook (Recommended): PowerMTA executes a pre-routing Lua script that intercepts outbound messages tagged for forwarding, computes the HMAC-SHA1 hash, and rewrites the recipient/sender envelope at memory speed.

4. Production Lua Pre-Submission Script for PowerMTA

Deploy this high-performance Lua script in /etc/pmta/srs.lua to handle envelope rewriting within PowerMTA:

-- ==============================================================================
-- POWERMTA LUA SENDER REWRITING SCHEME (SRS) ENGINE
-- ==============================================================================

local sha1 = require("sha1")
local secret = "YourEnterpriseCryptoSecretKey2026!"
local forwarder_domain = "forwarder.org"

function rewrite_srs(msg)
    local orig_sender = msg:getSender()
    
    -- Ignore blank senders (NDR / bounce messages) and existing SRS tokens
    if orig_sender == "" or orig_sender:match("^SRS[01]=") then
        return
    end
    
    local local_part, domain = orig_sender:match("^(.-)@(.+)$")
    if not local_part or not domain then
        return
    end
    
    -- Calculate 2-character base32 timestamp (21-day sliding window)
    local days = math.floor(os.time() / 86400) % 1024
    local time_token = string.format("%02X", days % 256)
    
    -- Generate HMAC hash: first 4 base64 characters
    local hash_data = string.lower(time_token .. domain .. local_part)
    local hmac = sha1.hmac(secret, hash_data)
    local hash_token = string.sub(hmac, 1, 4)
    
    -- Construct standard SRS0 envelope sender
    local srs_sender = string.format("SRS0=%s=%s=%s=%s@%s", 
        hash_token, time_token, domain, local_part, forwarder_domain)
        
    -- Update PowerMTA envelope sender
    msg:setSender(srs_sender)
    msg:setHeader("X-SRS-Rewritten", "by PowerMTA at " .. os.date("!%Y-%m-%dT%H:%M:%SZ"))
end

To enable this script in your /etc/pmta/config, reference it inside your forwarding Virtual MTA pool:

<virtual-mta vmta-forwarding-pool>
    smtp-source-ip 198.51.100.50
    host-name mail.forwarder.org
    
    # Load and bind Lua SRS processor
    lua-script /etc/pmta/srs.lua
    lua-on-submit rewrite_srs
</virtual-mta>

5. Inbound Reverse Mapping & Bounce Processing

The entire reason SRS includes cryptographic tokens is to safely handle Non-Delivery Reports (NDRs). If Gmail cannot deliver the forwarded message to Bob (e.g., Bob’s mailbox is full or disabled), Gmail generates a bounce message addressed to the SRS return path:

RCPT TO:<SRS0=HHH=TT=sender.com=alice@forwarder.org>

When PowerMTA receives this bounce, its inbound MX processor executes the reverse translation:

1. Extracts the timestamp TT and verifies it has not expired (< 21 days).
2. Recomputes the HMAC-SHA1 hash using the server secret. If the hash does not match HHH, the message is rejected with 550 Invalid SRS signature (blocking backscatter attacks).
3. Extracts the original sender alice@sender.com and transparently delivers the bounce notice back to Alice!

6. Forwarding Delivery Mechanisms Comparison Matrix