Mail¶

Mailing Lists¶

Normal mailing lists are managed by Google GSuite and our external sync system.

Restricted Mail¶

The first entrypoint for our mail is GSuite. The restricted address needs to be forwarded to our local postfix server. The mail is from now on handled by LEGO.

Steps:

Mail hits GSuite and gets forwarded to out local postfix instance.
Transport maps is used to forward mail to the LMTP server running in LEGO.
LEGO uses the token attached to the message to decide where to send the message.
We transform the message to pass SPF, DKIM and DMARC.
LEGO sends out the new message to all recipients.

To start the LMTP server:

python manage.py restricted_email

LMTP stands for Local Mail Transfer Protocol and is almost the same protocol as SMTP.

The LMTP server has two settings:

LMTP_HOST = '0.0.0.0'
LMTP_PORT = 8024

Postfix Configuration¶

This section describes some important parts of the Postfix settings.

TLS settings¶

main.cf

smtpd_tls_cert_file=/etc/ssl/abakus/star.abakus.no.bundle.crt
smtpd_tls_key_file=/etc/ssl/abakus/star.abakus.no.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

Relay settings / Transports¶

We use smtp-relay.gmail.com for outgoing mail.

main.cf

smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
header_size_limit = 4096000
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
transport_maps = hash:/etc/postfix/transport

tls_policy

[smtp-relay.gmail.com]:587  encrypt

transport

<restricted_address>@<restricted_domain>    lmtp:[<lmtp_host>]:<lmtp_port>
*           smtp:[smtp-relay.gmail.com]:587

Other common settings¶

The most important parts of these settings is the RPL lists. Consider this as an example.

main.cf

smtpd_relay_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    defer_unauth_destination
    reject_invalid_hostname
    reject_non_fqdn_sender
    reject_unknown_sender_domain
    reject_unknown_recipient_domain
    reject_unauth_pipelining
    reject_rbl_client bl.spamcop.net
    reject_rbl_client sbl-xbl.spamhaus.org
    reject_rbl_client cbl.abuseat.org
    reject_rbl_client b.barracudacentral.org
    check_policy_service inet:127.0.0.1:10023  # PostGrey

mydestination = luke.abakus.no, localhost.abakus.no, localhost, abakus.no, nyitrondheim.no, hs.abakus.no

mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 129.241.208.0/23
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4

# Spamassassin Milter
milter_protocol = 2
milter_default_action = accept
smtpd_milters = unix:/spamass/spamass.sock
milter_connect_macros = i j {daemon_name} v {if_name} _