OK. Worked it out. The reason it works when tested on premises is because the Public IP of the on premises network is recorded in the SPF record. However, when SOF1 was installed on a VPS externally, it's IP needed to be added to the SPF record as well, without which the above errors occurs if Connection Filter is set to anything other than 10.
From another post in the forums, we found that emails will only flow through SOF1 if we set the Connection filter to 10. Setting it to anything else results in the above failures. Do RBLs still work if the Connection filter is set to 10 ? What else is disabled if the filter is set to 10 ? Better yet, is there a way around this ?
There were 3 domains in total. I have scrapped the install and started completely from scratch again. This time I selected a different domain to test with which is hosted with a different mail server. The SOF1 now only has one domain (eg. mycompany.com). The Connect tab has (details changed) :- Hostname : mailfilter01 Local IP : 11.22.33.44 (the public IP of the VPS) Mask : 32 Gateway : 99.88.77.66 (gateway provided by provider) DNS Servers : 127.0.0.1 followed by providers DNS servers DNS Suffixes...
We tested Scrollout by installing from the iso internally and it works. So we wanted to move it to a VPS. As we can't install from the iso with VPS, we started with a clean netinstall of Debian 9, then followed the instructions from the website to install Scrollout F1 which appears to have gone through successfully. We proceeded to configure SOF1 the same as we did when testing internally (except for networking / Connect details). Under Route we setup the 3 domains we use (eg. company1.com, company2.com...