mailcow-dockerized icon indicating copy to clipboard operation
mailcow-dockerized copied to clipboard

Sender Dependent Transports but on User level

Open 8rooti opened this issue 4 years ago • 16 comments

Hey Everyone

Is there a way to use configure Sender Dependent transport feature on a user level instead of on domain level?

As an example, I have just one domain in mailcow mybusiness.com. Have added 3 users and have added two relays; smtp-relay.gmail.com and outlook.com

[email protected] to use no relays [email protected] to use gmail relay [email protected] to use outlook relay

Anyone know how I can achieve this? Or is this is not possible currently?

Thanks,

8rooti avatar May 22 '21 11:05 8rooti

Implemented by https://github.com/mailcow/mailcow-dockerized/commit/5065667ae467261d6a2336ec01faf9d26998044c

andryyy avatar May 26 '21 12:05 andryyy

In your case you'd not set a domain transport but a mailbox transport for user2 and user3.

andryyy avatar May 26 '21 12:05 andryyy

Maybe this can be extended somehow for mailaddresses? Actually I'm using this for "external" addresses described in https://github.com/mailcow/mailcow-dockerized/issues/4022#issuecomment-848678167 (and only for those).

waja avatar May 27 '21 21:05 waja

I cannot use the sasl name at this point. External addresses would work, but only if the external address is not allowed for another user. :/ Would that help?

andryyy avatar May 27 '21 21:05 andryyy

Nope, the sasl users also sends mail (in my case) that is local on this machine and those should not be relayed by those transports. Somehow the external (sender) addresses needs to be linked to one of those transports.

(in my case two of them (sasl user a) needs to be linked to one transport and two other (sasl user b) to another transport, and yes, those external addresses are not allowed by another user )

waja avatar May 27 '21 22:05 waja

I cannot use the sasl name at this point. External addresses would work, but only if the external address is not allowed for another user. :/ Would that help?

André, any chance this could be revisited? I have a user with a freemail external address with a rigid SPF policy, that's resulting in severe delivery problems to Google (at least).

I have checked the SQL queries and understand why external addresses would have to be unique across the installation, but I don't see that as a problem. Do you think there's a valid use case for re-using external addresses?

mamash avatar Apr 27 '22 17:04 mamash

But you can assign a relay to a user. If you are using a non-mailcow mailbox then no, it’s still not working.

Is that really what you are trying to do?

andryyy avatar Apr 27 '22 18:04 andryyy

But you can assign a relay to a user. If you are using a non-mailcow mailbox then no, it’s still not working.

Is that really what you are trying to do?

Yeah, that's exactly what I'm trying to do. Keep an external (freemail) address, route it through Mailcow in-and-out, and yet comply with their SPF policy by relaying through their SMTP. I think I can nail the necessary SQL adjustment to take sender_acl into account and run it from my fork though.

mamash avatar Apr 27 '22 22:04 mamash

Here's a minimum diff to postfix.sh that works for me and gives me spf=pass and dmarc=pass with Google. I'm fine running this on my small installation, but obviously per-site unique external addresses are assumed, so proper UI/db checks should be implemented.

mamash avatar Apr 28 '22 08:04 mamash

Yes, external addresses would work as long as they are unique per site.

andryyy avatar Apr 28 '22 21:04 andryyy

just tried to apply a different sender-dependent-transport to a user of one domain that already has a different sender-dependant-transport. however it looks like the user credentials of the domain are used for the user trying to access the different sender-dependant-transport. of course that fails. can somebody confirm that?

To make it clear:

Domain: [server a -> credentials a] User : [server b -> credentials b]

What is actually happenening: User [server b is logged in with credentials a -> fail]

Skydiver84de avatar Oct 09 '22 12:10 Skydiver84de

This would be nice, but should be an option per domain and user. As admin

vermium avatar Jan 20 '23 12:01 vermium

You can now do that: image I think this can be closed.

rareseu avatar Jun 15 '23 08:06 rareseu

This is an account dependent transport implementation. Sender can be also an alias address (or maybe a address not hosted on this mailserver anyway).

waja avatar Jun 15 '23 08:06 waja

But you should be authenticated when sending a mail from the server anyway.

Doesn’t work for unauthenticated, yes, you can implement it according to Postfix docs.

andryyy avatar Jun 15 '23 10:06 andryyy