Advanced postfix question: IP and reverse DNS

[Johannes Nohl]

Dear list,

maybe someone here's a postfix guru. I have a problem which I don't
know if it's solvable at all.

I have a machine running as mail server for several domains. Each
domain has its own IP. For each IP I can set up a reverse DNS entry.

How can I configure postfix to send e-mail using different IPs
depending on sender domain?

Thanks.

[Per Jessen]

Post by Johannes Nohl
Dear list,
maybe someone here's a postfix guru. I have a problem which I don't
know if it's solvable at all.
I have a machine running as mail server for several domains. Each
domain has its own IP. For each IP I can set up a reverse DNS entry.
How can I configure postfix to send e-mail using different IPs
depending on sender domain?

You set up different outbound transports, eg. smtpdomain1, smtpdomain2
etc. For each one you assign an IP using the smtp_bind_address
setting. Then you use a transport table to select the outbound
transport depending on the domain.


/Per Jessen, Zürich

[Johannes Nohl]

Post by Per Jessen

Post by Johannes Nohl
maybe someone here's a postfix guru. I have a problem which I don't
know if it's solvable at all.
I have a machine running as mail server for several domains. Each
domain has its own IP. For each IP I can set up a reverse DNS entry.
How can I configure postfix to send e-mail using different IPs
depending on sender domain?

You set up different outbound transports, eg. smtpdomain1, smtpdomain2
etc. For each one you assign an IP using the smtp_bind_address
setting. Then you use a transport table to select the outbound
transport depending on the domain.

Thanks for your fast answer but I've never seen such a setup. How do I
set smtpdomainX? All I've seen so far is one configuration for one
server. How do I splitt it up? Is it inside main.cf?

Thanks!

[Per Jessen]

Post by Johannes Nohl
Thanks for your fast answer but I've never seen such a setup. How do I
set smtpdomainX? All I've seen so far is one configuration for one
server. How do I splitt it up? Is it inside main.cf?

Hi Johannes

you set up the transports in master.cf:

smtp2 unix - - n - - smtp
-o smtp_bind_address=1.2.3.2
smtp3 unix - - n - - smtp
-o smtp_bind_address=1.2.3.3
smtp4 unix - - n - - smtp
-o smtp_bind_address=1.2.3.4
smtp5 unix - - n - - smtp
-o smtp_bind_address=1.2.3.5
smtp6 unix - - n - - smtp
-o smtp_bind_address=1.2.3.6

Your transport table:

<domain> smtp2:
<domain> smtp3:
<domain> smtp4:
<domain> smtp5:
<domain> smtp6:


I haven't tested this, but I'm pretty certain it should work.


/Per Jessen, Zürich

[Hylton Conacher (ZR1HPC)]

Post by Johannes Nohl
Dear list,
maybe someone here's a postfix guru. I have a problem which I don't
know if it's solvable at all.
I have a machine running as mail server for several domains. Each
domain has its own IP. For each IP I can set up a reverse DNS entry.
How can I configure postfix to send e-mail using different IPs
depending on sender domain?

You could also ask the question on postfix-***@postfix.org once you've
joined the Postfix list as I am pretty sure they would have an answer
for you.

HIH

[Johannes Nohl]

Dear Per and others!

Post by Per Jessen

Post by Johannes Nohl
Thanks for your fast answer but I've never seen such a setup. How do I
set smtpdomainX? All I've seen so far is one configuration for one
server. How do I splitt it up? Is it inside main.cf?

Hi Johannes
smtp2 unix - - n - - smtp
-o smtp_bind_address=1.2.3.2
smtp3 unix - - n - - smtp
-o smtp_bind_address=1.2.3.3
smtp4 unix - - n - - smtp
-o smtp_bind_address=1.2.3.4
smtp5 unix - - n - - smtp
-o smtp_bind_address=1.2.3.5
smtp6 unix - - n - - smtp
-o smtp_bind_address=1.2.3.6
I haven't tested this, but I'm pretty certain it should work.

Well, I tried but it doesn't work. The left hand argument in transport
is for receipt not for sender. I want to choose the smtp by sender.

In older versions there was a switch called sender_based_routing. It's
abolished since postfix 2.3. I use postfix 2.4. Other mailing lists
call sender_based_routung as a error in design, don't know why.

The propsoed solutions are not suitable for me. Mostly they talk about
setting up a whole postfix instance for each IP. That's little too
much.

And because I've been asked at other places: I can't have more than
one rDNS record per IP. It's up to the hoster not up to me.

I was pointed to postfix-***@postfix.org. But in their archives I
can find several threads about. They all talk about a second instance.
One answered: "having 50-60 postfix instances per machine scares me. I
don't think this is a solution I can accept." That's true to me.

Thanks!

[Per Jessen]

Post by Johannes Nohl

Post by Per Jessen
Hi Johannes
smtp2 unix - - n - - smtp
-o smtp_bind_address=1.2.3.2
smtp3 unix - - n - - smtp
-o smtp_bind_address=1.2.3.3
smtp4 unix - - n - - smtp
-o smtp_bind_address=1.2.3.4
smtp5 unix - - n - - smtp
-o smtp_bind_address=1.2.3.5
smtp6 unix - - n - - smtp
-o smtp_bind_address=1.2.3.6
I haven't tested this, but I'm pretty certain it should work.

Well, I tried but it doesn't work. The left hand argument in transport
is for receipt not for sender. I want to choose the smtp by sender.

Hi Johannes,

I think you can use the 'sender_dependent_relayhost_maps' setting:

@domain1.com smtp1:
@domain2.com smtp2:
etc
etc



/Per Jessen, Zürich

[Sandy Drobic]

Post by Per Jessen

Post by Johannes Nohl

Post by Per Jessen
I haven't tested this, but I'm pretty certain it should work.

Well, I tried but it doesn't work. The left hand argument in transport
is for receipt not for sender. I want to choose the smtp by sender.

Hi Johannes,

Yes, it should work. This feature was introduced with Postfix 2.3. Better
check, if your version of Postfix provides this option:

"postconf mail_version" must show a version 2.3 or higher.

[Johannes Nohl]

Hm, don't know. I'm not relaying I send directly to recipient. I tried
and mail returned with following error:

<***@domain2.com>: Host or domain name not found. Name service error
for name=smtp2 type=AAAA: Host found but no data record of requested type

As far as I could read until now the sender_dependent_relayhost map
expects a domain as well on the right hand side, or? (like netxthop in
transport) E.g. smtp2:domainxy.com (it has to know to where to relay).

I'm somehow lost. I can't imagine that a used options is deprecated
and newer version don't substitute it...

Post by Sandy Drobic
Yes, it should work. This feature was introduced with Postfix 2.3. Better
"postconf mail_version" must show a version 2.3 or higher.

My version ist 2.4.5.


Thanks Sandy & Per, maybe you have a hint for me?

[Sandy Drobic]

Post by Johannes Nohl
Hm, don't know. I'm not relaying I send directly to recipient. I tried
for name=smtp2 type=AAAA: Host found but no data record of requested type

Your dns couldn't resolve the domain "domain2.com". Solve your dns setup
problem. If you have the smtp client in a chroot (master.cf the fifth column
must be "n" to disable chroot) make sure the dns configuration is accessible
to the smtp client.

This is not a problem with sender based routing.

Further help is almost impossible without posting of the configuration
(postconf -n, master.cf). My dns has no problem to resolve "domain2.com":

dig domain2.com

; <<>> DiG 9.4.1-P1 <<>> domain2.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42970
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;domain2.com. IN A

;; ANSWER SECTION:
domain2.com. 86400 IN A 211.106.65.110
domain2.com. 86400 IN A 211.106.65.118

;; AUTHORITY SECTION:
domain2.com. 86400 IN NS ns.domainca.com.
domain2.com. 86400 IN NS ns2.domainca.com.

If this is an attempt to obfuscate the real domain, please use "example.com"
or "example.org".

Post by Johannes Nohl
As far as I could read until now the sender_dependent_relayhost map
expects a domain as well on the right hand side, or? (like netxthop in
transport) E.g. smtp2:domainxy.com (it has to know to where to relay).
I'm somehow lost. I can't imagine that a used options is deprecated
and newer version don't substitute it...

I'm a bit lost as well. (^-^)
As far as I know, Postfix didn't support sender based routing before version 2.3.

If you really need routing based on the sender address you could also use the
FILTER action in a check_sender_access.

smtpd_sender_restrictions =
check_sender_access hash:/etc/postfix/senderdomain_routing

/etc/postfix/senderdomain_routing:
example1.com FILTER domain1-smtp:
example2.com FILTER domain2-smtp:

By the way, did you execute "postfix reload" after making changes to master.cf
or main.cf?

[Per Jessen]

Post by Johannes Nohl
Hm, don't know. I'm not relaying I send directly to recipient. I tried
for name=smtp2 type=AAAA: Host found but no data record of
requested type

Maybe you forgot the ':'? There shold be absolutely no reason for
postfix to lookup 'smtp2'. Is smtp2 defined in master.cf ?

(are you on IPV6?)

Post by Johannes Nohl
As far as I could read until now the sender_dependent_relayhost map
expects a domain as well on the right hand side, or? (like netxthop in
transport) E.g. smtp2:domainxy.com (it has to know to where to relay).

No, it doesn't. If you don't specify where to relay, the nexthop is the
MX for the recipient domain.




/Per Jessen, Zürich

[Johannes Nohl]

Hello Sandy & Per,

first I list my configuration, I work with IPv4:

master.cf:

smtp unix - - n - - smtp
# ^ first IP for all except example.com
# bind second IP for example.com
smtp155 unix - - n - - smtp
-o smtp_bind_address=xx.xx.xx.155

- - -

main.cf:

sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay

- - -

/etc/postfix/sender_relay:

@example.com smtp155:

- - -

I did postmap sender_relay and rcpostfix reload.


- - -

dig example.com:

; <<>> DiG 9.4.1-P1 <<>> example.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18538
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;example.com. IN A

;; ANSWER SECTION:
example.com. 3544 IN A xy.xy.xy.xy

;; Query time: 2 msec
;; SERVER: xy.xy.xy.xy#53(xy.xy.xy.xy)
;; WHEN: Sun Jan 20 19:06:24 2008
;; MSG SIZE rcvd: 51

Post by Per Jessen

Post by Johannes Nohl
As far as I could read until now the sender_dependent_relayhost map
expects a domain as well on the right hand side, or? (like netxthop in
transport) E.g. smtp2:domainxy.com (it has to know to where to relay).

No, it doesn't. If you don't specify where to relay, the nexthop is the
MX for the recipient domain.

So it works like transport basically?

I send a test mail:

mail -r ***@example.com -s test ***@xyz.com

It returns the described error:
<***@xyz.com>: Host or domain name not found. Name service
error for name=smtp155 type=AAAA: Host found but no data record of
requested type

What's the meaning of "Host found but no data record of requested type"?

Why does it work if I have a empty /etc/postfix/sender_relay? Without
DNS errors?

Thanks.

[Johannes Nohl]

Post by Johannes Nohl
; <<>> DiG 9.4.1-P1 <<>> example.com
;; global options: printcmd
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18538
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;example.com. IN A
example.com. 3544 IN A xy.xy.xy.xy
;; Query time: 2 msec
;; SERVER: xy.xy.xy.xy#53(xy.xy.xy.xy)
;; WHEN: Sun Jan 20 19:06:24 2008
;; MSG SIZE rcvd: 51

That was wrong of course, the dig wasn't for example.com. It was xyz.com:

dig xyz.com:

; <<>> DiG 9.4.1-P1 <<>> xyz.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18538
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;xyz.com. IN A

;; ANSWER SECTION:
xyz.com. 3544 IN A xy.xy.xy.xy

;; Query time: 2 msec
;; SERVER: xy.xy.xy.xy#53(xy.xy.xy.xy)
;; WHEN: Sun Jan 20 19:06:24 2008
;; MSG SIZE rcvd: 51

[Johannes Nohl]

More from my master.cf. I've integrated amavisd-new. Maybe this is
disturbing the rest??

# hand over an spam / virus filter
amavisfeed unix - - n - 2 lmtp
-o lmtp_data_done_timeout=1200
-o lmtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20
# Reinjection
127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-o local_header_rewrite_clients=

[Sandy Drobic]

Post by Johannes Nohl
More from my master.cf. I've integrated amavisd-new. Maybe this is
disturbing the rest??
# hand over an spam / virus filter
amavisfeed unix - - n - 2 lmtp
-o lmtp_data_done_timeout=1200
-o lmtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20
# Reinjection
127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o smtpd_restriction_classes=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-o local_header_rewrite_clients=

No, the problem is a bit more difficult than I thought. I looked up some
remarks from Wietse on smtp_bind_address and routing, and the answer is that
you NEED separate instances if you really want sender_based smtp_bind_address.

So, you will either have to set up separate instances (it's not THAT much
work) or use the normal routing with sending ip.

Why do you want separate sending ip addresses with on postfix instance anyway?
With multiple instances you get a separate queue for each instance and you can
fine tune the configuration for each instance.

[Per Jessen]

Post by Johannes Nohl
smtp unix - - n - - smtp
# ^ first IP for all except example.com
# bind second IP for example.com
smtp155 unix - - n - - smtp
-o smtp_bind_address=xx.xx.xx.155

Looks good.

Post by Johannes Nohl
sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay

Good.
Good.

Post by Johannes Nohl
error for name=smtp155 type=AAAA: Host found but no data record of
requested type

This looks to me as if postfix is trying to lookup an IPV6 address
for 'smtp155' when trying to deliver mail to xyz.com.
I don't understand why 'smtp155' is somehow being seen as a hostname,
instead of just a symbolic name of a transport.



/Per Jessen, Zürich

[Per Jessen]

Post by Per Jessen

Post by Johannes Nohl
error for name=smtp155 type=AAAA: Host found but no data record
of requested type

This looks to me as if postfix is trying to lookup an IPV6 address
for 'smtp155' when trying to deliver mail to xyz.com.
I don't understand why 'smtp155' is somehow being seen as a hostname,
instead of just a symbolic name of a transport.

OK, it seems that the right-hand side of an entry in the table
for 'sender_dependent_relayhost_maps' is a hostname, not a
transport-name.
So then you're back to Sandys suggestion of using check_sender_access
with FILTER results, but judging by his research, it doesn't seem
possible after all.



/Per Jessen, Zürich

[Johannes Nohl]

Post by Per Jessen
So then you're back to Sandys suggestion of using check_sender_access
with FILTER results, but judging by his research, it doesn't seem
possible after all.

I would have never thought that. It seems that it was possible until
postfix 2.2 using sender_based_routing.

What Sandy said was that it isn't doable at all. As I understood even
not with FILTER.

THANKS FOR YOUR HELP.

I will try another MTA. It's said because I spent much time to learn
about postfix. Don't know, I'll look around qmail, exim... On of them
will do it.

Bye,

Johannes

[Sandy Drobic]

Post by Johannes Nohl

Post by Per Jessen
So then you're back to Sandys suggestion of using check_sender_access
with FILTER results, but judging by his research, it doesn't seem
possible after all.

I would have never thought that. It seems that it was possible until
postfix 2.2 using sender_based_routing.
What Sandy said was that it isn't doable at all. As I understood even
not with FILTER.

NOT WITHOUT SEPARATE INSTANCES. If you set up separate instances it would work.

[Johannes Nohl]

Post by Sandy Drobic

Post by Johannes Nohl
What Sandy said was that it isn't doable at all. As I understood even
not with FILTER.

NOT WITHOUT SEPARATE INSTANCES. If you set up separate instances it would work.

Ok, but that would mean that I have to set up at least 4 instances.
And I have no idea right now what about the content filter (amavis)
and it's helpers (clam, spamassassin). It's too much, probably.

Johannes

[Sandy Drobic]

Post by Johannes Nohl

Post by Sandy Drobic

Post by Johannes Nohl
What Sandy said was that it isn't doable at all. As I understood even
not with FILTER.

NOT WITHOUT SEPARATE INSTANCES. If you set up separate instances it would work.

Ok, but that would mean that I have to set up at least 4 instances.
And I have no idea right now what about the content filter (amavis)
and it's helpers (clam, spamassassin). It's too much, probably.

Not really, you just have to configure amavisd-new as if you would provide the
service for several servers. The internal amavisd-new settings wouldn't change
at all.

I spent a lot of time to get familiar with Postfix, so it's easier for me to
configure Postfix to do what I want than to spend the time to break in another
mta. Your mileage may vary.