Julian Kippels writes:
Historically I had users and mailinglists mixed together in the same namespace. This has grown a bit out of control and is really complicating things on the identity management side of things. I would like to have a simple route defined on my mta that sends everything from the new domain over to the new server instead of having to look up everything in LDAP all the time.
I'm not sure I understand this. I heartily approve of moving your Mailman instance to a separate host because Mailman, Django, and Python all present large attack surfaces. Isolating the system on a separate host makes a lot of sense.
But I'm not sure it's worth renaming the domain to lists.domain.tld if you already have list@domain.tld addresses that your users are used to. Especially if you use a convention like topic-list@domain.tld so users know whether something is a list or not.
These namespaces (lists and other addresses) should be disjoint, right? Then the question is how to handle conflicts. At routing time, I would just give mailing lists priority, and check for a mailing list first in the MX. It wouldn't be hard to hack an LDAP check for an existing non-Mailman address into the MailingList.create function, and a little more effort to handle that in the command line and Postorius list creation UIs. I can't speak to how to automate the creation of a non-Mailman email address, but similar SQL query should be scriptable for many common cases.
Unless you have a truly enormous number of lists (surely > 20,000, that's painful for other reasons, but not because it's costly to route), the Postfix table lookup is quite fast. This appears as just one rule in main.cf, and Mailman does the maintenance for you as lists are created and deleted.
And Mailman basically doesn't care what the name of the host it runs on is. It only cares that the SMTP RCPT TO match its own database list name and mail host at LMTP acceptance time. So you can move the processing to lists.domain.tld and Mailman won't notice.
If you still want to do the list renaming, we'll do what we can to help, but there's some risk, especially on the "annoying the subscribers" side. OTOH, I'm not sure that you save very much processing by simplifying the MX config to a domain check vs. a full address check, as long as you give Mailman addresses priority.
-- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan