3

We have an application that generates outbound email for a range of domains. The app servers connect to a part of Postfix servers in a DMZ and these then forward on to filtering in a second DMZ. We need to apply DKIM at this second stage and the key selection depends on the domain of the mail sender.

The filtering system sees only the IP address of the postfix servers so we can't create a rule for DKIM signing based on the source IP. What I want to be able to do is make each mail appear to come from a different host on the way out of Postfix, I don't want to change the sender domain - that needs to be untouched.

So the flow should look like:

  1. App sends mail from sender@foo.com to j.doe@somewhere.com

Postfix accepts mail and forwards it to filtering system from relay.foo.com

Filtering sees mail for sender@foo.com from relay.foo.com and applies foo.com DKIM signature before sending to external relay for delivery to j.doe@somewhere.com

  1. App sends mail from sender@bar.com to j.doe@somewhere.com

Postfix accepts mail and forwards it to filtering system from relay.bar.com

Filtering sees mail for sender@bar.com from relay.bar.com and applies bar.com DKIM signature before sending to external relay for delivery to j.doe@somewhere.com.

The only thing we want to change is the originating server name when we forward the mail on from Postfix to the next hop filtering system.

  • My naïve approach would be to leverage milter_header_checks together with a separate smtp entry in master.cf for which the mydomain parameter has been overwritten. Just an idea though. The downside would be that this scales linearly with the number of possible sender domains. – tarleb Mar 16 '16 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.