in the SPF plugin for postfix, add (trusted => 1) to the parameters
Using trusted forwarders should be the default, right? We need to make certain this happens.