This is a bit of a lengthy post, but I wanted to make sure I had enough detail to document the problem I'm experiencing. The quick summary is, I'm having a problem with postfix, dovecot and mailman3.. routing Problem:
Postfix mail routing is mostly working correctly with the execpetion of handling test-confirm+157fcaf78907a2bbf21b36aaf349386e09e801a8@example.com emails. As you can see below in my postfix config, I have defined recipient_delimiter.. I'm not sure what else is going wrong.. For example, if I email test-confirm@example.com, the mail will route over to MM correctly as postfix is able to find this exact email address in the postfix_lmtp transport file. However, if I reply to a mm confirmaion email, test-confirm+157fcaf78907a2bbf21b36aaf349386e09e801a8@example.com, postfix will fail to deliver the email correctly due postfix trying to lookup the test-confirm@example.com in dovcot's virtual mailbox tables. I hope this is enough information...
My research seems to indicate I might need to change something with virtual_alias_maps, however from my testing, changing this setting to include MM3's geneated postfix_lmtp file, it'll cause more problems.. I've also considered using a sub-domain, for example lists.example.com instead of my primary domain for mm3, this may fix a lot of my issues.
Setup overview: Integrated mailcow-dockerized (https://github.com/andryyy/mailcow-dockerized) & docker-mailman (https://github.com/maxking/docker-mailman)
- all I have done is merged the containers from the docker-mailman docker-compose.yml into mailcow's docker-compose.yml
- updated the network settings for docker-mailman to use mailcow's internal network if needed, I can provide my docker-compose file.
mx1.example.com = An internal eMail firewall and security server
Below is the reject log from postfix: Jul 15 18:11:22 mx10 postfix/smtpd[418]: NOQUEUE: reject: RCPT from mx1.example.com[xxx.xxx.xxx.xxxx]: 550 5.1.1 < test-confirm+157fcaf78907a2bbf21b36aaf349386e09e801a8@example.com>: Recipient address rejected: User unknown in virtual mailbox table; from=< xxxx@gmail.com> to=< test-confirm+157fcaf78907a2bbf21b36aaf349386e09e801a8@example.com> proto=ESMTP helo=<mx1.example.com>
Below is my postfix configs: ##Postfix main.cnf biff = no append_dot_mydomain = no smtpd_tls_cert_file = /etc/ssl/mail/cert.pem smtpd_tls_key_file = /etc/ssl/mail/key.pem smtpd_use_tls=yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases relayhost = [mx1.example.com]:25 mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 [fd4d:6169:6c63:6f77::]/64 mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = all inet_protocols = all bounce_queue_lifetime = 1d broken_sasl_auth_clients = yes disable_vrfy_command = yes maximal_backoff_time = 1800s maximal_queue_lifetime = 1d message_size_limit = 26214400 milter_default_action = accept milter_protocol = 6 minimal_backoff_time = 300s plaintext_reject_code = 550 postscreen_access_list = permit_mynetworks, cidr:/opt/postfix/conf/postscreen_access.cidr, tcp:127.0.0.1:10027 postscreen_bare_newline_enable = no postscreen_blacklist_action = drop postscreen_cache_cleanup_interval = 24h postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache postscreen_dnsbl_action = enforce postscreen_dnsbl_sites = b.barracudacentral.org=127.0.0.2*7 dnsbl.inps.de=127.0.0.2*7 bl.mailspike.net=127.0.0.2*5 bl.mailspike.net=127.0.0.[10;11;12]*4 dnsbl.sorbs.net=127.0.0.10*8 dnsbl.sorbs.net=127.0.0.5*6 dnsbl.sorbs.net=127.0.0.7*3 dnsbl.sorbs.net=127.0.0.8*2 dnsbl.sorbs.net=127.0.0.6*2 dnsbl.sorbs.net=127.0.0.9*2 zen.spamhaus.org=127.0.0.[10;11]*8 zen.spamhaus.org=127.0.0.[4..7]*6 zen.spamhaus.org=127.0.0.3*4 zen.spamhaus.org=127.0.0.2*3 hostkarma.junkemailfilter.com=127.0.0.2*3 hostkarma.junkemailfilter.com=127.0.0.4*1 hostkarma.junkemailfilter.com=127.0.1.2*1 wl.mailspike.net=127.0.0.[18;19;20]*-2 hostkarma.junkemailfilter.com=127.0.0.1*-2 postscreen_dnsbl_threshold = 8 postscreen_dnsbl_ttl = 5m postscreen_greet_action = enforce postscreen_greet_banner = $smtpd_banner postscreen_greet_ttl = 2d postscreen_greet_wait = 3s postscreen_non_smtp_command_enable = no postscreen_pipelining_enable = no proxy_read_maps = proxy:mysql:/opt/postfix/conf/sql/ mysql_virtual_sender_acl.cf, proxy:mysql:/opt/postfix/conf/sql/ mysql_tls_enforce_out_policy.cf, proxy:mysql:/opt/postfix/conf/sql/ mysql_tls_enforce_in_policy.cf, $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps queue_run_delay = 300s relay_domains = proxy:mysql:/opt/postfix/conf/sql/ mysql_virtual_relay_domain_maps.cf relay_recipient_maps = proxy:mysql:/opt/postfix/conf/sql/ mysql_relay_recipient_maps.cf sender_dependent_default_transport_maps = proxy:mysql:/opt/postfix/conf/sql/ mysql_tls_enforce_out_policy.cf smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt smtp_tls_cert_file = /etc/ssl/mail/cert.pem smtp_tls_key_file = /etc/ssl/mail/key.pem smtp_tls_loglevel = 1 smtp_dns_support_level = dnssec smtp_tls_security_level = dane smtpd_data_restrictions = reject_unauth_pipelining, permit smtpd_delay_reject = yes smtpd_error_sleep_time = 10s smtpd_hard_error_limit = ${stress?1}${stress:5} smtpd_helo_required = yes smtpd_proxy_timeout = 600s smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, check_recipient_access proxy:mysql:/opt/postfix/conf/sql/ mysql_tls_enforce_in_policy.cf, reject_invalid_helo_hostname, reject_unknown_reverse_client_hostname, reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_path = inet:dovecot:10001 smtpd_sasl_type = dovecot smtpd_sender_login_maps = proxy:mysql:/opt/postfix/conf/sql/ mysql_virtual_sender_acl.cf smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch, permit_mynetworks, reject_sender_login_mismatch, permit_sasl_authenticated, reject_unlisted_sender, reject_unknown_sender_domain smtpd_soft_error_limit = 3 smtpd_tls_auth_only = yes smtpd_tls_dh1024_param_file = /etc/ssl/mail/dhparams.pem smtpd_tls_eecdh_grade = strong smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA, RC4, aNULL smtpd_tls_loglevel = 1 smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 smtp_tls_protocols = !SSLv2, !SSLv3 lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3 lmtp_tls_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_ciphers = high smtpd_tls_security_level = may tls_ssl_options = NO_COMPRESSION tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA transport_maps = regexp:/opt/mailman/core/var/data/postfix_lmtp local_recipient_maps = regexp:/opt/mailman/core/var/data/postfix_lmtp proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mailbox_maps.cf virtual_alias_maps = proxy:mysql:/opt/postfix/conf/sql/ mysql_virtual_alias_maps.cf, proxy:mysql:/opt/postfix/conf/sql/ mysql_virtual_spamalias_maps.cf, proxy:mysql:/opt/postfix/conf/sql/ mysql_virtual_alias_domain_maps.cf, proxy:mysql:/opt/postfix/conf/sql/ mysql_virtual_alias_domain_catchall_maps.cf virtual_gid_maps = static:5000 virtual_mailbox_base = /var/vmail/ virtual_mailbox_domains = proxy:mysql:/opt/postfix/conf/sql/ mysql_virtual_domains_maps.cf virtual_mailbox_maps = regexp:/opt/mailman/core/var/data/postfix_lmtp proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mailbox_maps.cf virtual_minimum_uid = 104 virtual_transport = lmtp:inet:dovecot:24 virtual_uid_maps = static:5000 smtpd_milters = inet:rspamd:9900 non_smtpd_milters = inet:rspamd:9900 milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen} mydestination = localhost.localdomain, localhost #content_filter=zeyple # Prefere IPv4, useful for v4-only envs smtp_address_preference = ipv4 smtp_header_checks = pcre:/opt/postfix/conf/mailcow_anonymize_headers.pcre
unknown_local_recipient_reject_code = 550 owner_request_special = no
Note: I've replaced my real domain name with example.com, as I don't wish to have my server information publicly archived for spam and security reasons. I have also masked any external IP addreses. I'm also aware my email setup is a bit more complicated than the usual as I have an email firewall/security server in the mix. I've tried my best to accurately describe what I have configured. If you need any actual logs or configs, please contact me directly off this list for this information.
-- --Matt