We have an application that generates outbound email for a range of domains. The app servers connect to a part of Postfix servers in a DMZ and these then forward on to filtering in a second DMZ. We need to apply DKIM at this second stage and the key selection depends on the domain of the mail sender.
The filtering system sees only the IP address of the postfix servers so we can't create a rule for DKIM signing based on the source IP. What I want to be able to do is make each mail appear to come from a different host on the way out of Postfix, I don't want to change the sender domain - that needs to be untouched.
So the flow should look like:
- App sends mail from email@example.com to firstname.lastname@example.org
Postfix accepts mail and forwards it to filtering system from relay.foo.com
Filtering sees mail for email@example.com from relay.foo.com and applies foo.com DKIM signature before sending to external relay for delivery to firstname.lastname@example.org
- App sends mail from email@example.com to firstname.lastname@example.org
Postfix accepts mail and forwards it to filtering system from relay.bar.com
Filtering sees mail for email@example.com from relay.bar.com and applies bar.com DKIM signature before sending to external relay for delivery to firstname.lastname@example.org.
The only thing we want to change is the originating server name when we forward the mail on from Postfix to the next hop filtering system.