Mail¶
Mailing Lists¶
Normal mailing lists are managed by Google GSuite and our external sync system.
Restricted Mail¶
The first entrypoint for our mail is GSuite. The restricted address needs to be forwarded to our local postfix server. The mail is from now on handled by LEGO.
Steps:
Mail hits GSuite and gets forwarded to out local postfix instance.
Transport maps is used to forward mail to the LMTP server running in LEGO.
LEGO uses the token attached to the message to decide where to send the message.
We transform the message to pass SPF, DKIM and DMARC.
LEGO sends out the new message to all recipients.
To start the LMTP server:
python manage.py restricted_email
LMTP stands for Local Mail Transfer Protocol and is almost the same protocol as SMTP.
The LMTP server has two settings:
LMTP_HOST = '0.0.0.0'
LMTP_PORT = 8024
Postfix Configuration¶
This section describes some important parts of the Postfix settings.
TLS settings¶
main.cf
smtpd_tls_cert_file=/etc/ssl/abakus/star.abakus.no.bundle.crt
smtpd_tls_key_file=/etc/ssl/abakus/star.abakus.no.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
Relay settings / Transports¶
We use smtp-relay.gmail.com
for outgoing mail.
main.cf
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
header_size_limit = 4096000
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
transport_maps = hash:/etc/postfix/transport
tls_policy
[smtp-relay.gmail.com]:587 encrypt
transport
<restricted_address>@<restricted_domain> lmtp:[<lmtp_host>]:<lmtp_port>
* smtp:[smtp-relay.gmail.com]:587
Other common settings¶
The most important parts of these settings is the RPL lists. Consider this as an example.
main.cf
smtpd_relay_restrictions =
permit_mynetworks
permit_sasl_authenticated
defer_unauth_destination
reject_invalid_hostname
reject_non_fqdn_sender
reject_unknown_sender_domain
reject_unknown_recipient_domain
reject_unauth_pipelining
reject_rbl_client bl.spamcop.net
reject_rbl_client sbl-xbl.spamhaus.org
reject_rbl_client cbl.abuseat.org
reject_rbl_client b.barracudacentral.org
check_policy_service inet:127.0.0.1:10023 # PostGrey
mydestination = luke.abakus.no, localhost.abakus.no, localhost, abakus.no, nyitrondheim.no, hs.abakus.no
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 129.241.208.0/23
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4
# Spamassassin Milter
milter_protocol = 2
milter_default_action = accept
smtpd_milters = unix:/spamass/spamass.sock
milter_connect_macros = i j {daemon_name} v {if_name} _