Just a suggestion. To both work around SPF, potential blacklisting and indirectly reduce your bandwidth fee's, provide the option for a helpdesk operator to optionally specify a submission server along with authentication, falling back to your existing method if none provided.
For example if Mary of maryjane.example.com wants emails to be sent via her own mail server, she could fill in the following options: -
* Outbound Email Host: mail.maryjane.example.com
* Outbound Email Port (25 or 587 being defaults normally)
* Outbound Username
* Outbound Password
This means all mail will come from her server's IP address rather than the freshdesk one.
This also indirectly works around a bug with the freshdesk MTA. It does not seem obey RFC-2821 properly in that it does not wait for responses from the mail server before sending its next response. This trips a bunch of anti-spam measures that have to be manually whitelisted around. I'll log this as a bug later once I've tested it properly and can put down more details.
