Why does an alias using an external mail domain prevent outbound delivery to that domain?

[engaged1]

Hi,
I set up an eMail alias for two of the users of my DMS. Everything went fine so far with the setup.sh-commands. The domain of each eMail-alias is different to the main domain of the DMS so I installed sender-specific relay hosts, too.

But now I recognized a wired behavior because every eMail I send to a recipient with the same domain as the eMail-alias is just transferred locally. And because of the fact that both eMail-aliases are from big eMail-providers every time I try to write an eMail to somebody with a corresponding domain dovecot writes me that it can't find the relevant user on my local DMS! Of course it can't find any of them as I never intended it should.

For example, "user 1" has a main email address [email protected] and an alias with [email protected] and wants to write his friend "Foo Bar" via email to [email protected]. I get this message of my local dovecot:

2024-10-22T07:47:06.994806+02:00 mail dovecot: auth: passwd-file([email protected]): unknown user 
2024-10-22T07:47:07.001378+02:00 mail postfix/lmtp[851974]: D802BAC5CD9: to=<[email protected]>, relay=http://dockermailserver.mydomain.tld[/var/run/dovecot/lmtp], delay=0.12, delays=0.07/0.02/0.02/0.01, dsn=5.1.1, status=bounced (host http://dockermailserver.mydomain.tld[/var/run/dovecot/lmtp] said: 550 5.1.1 <[email protected]> User doesn't exist: [email protected] (in reply to RCPT TO command))

At the moment I don't know what to do or search for so help is welcome!
Best regards.

[casperklein]

For example, "user 1" has a main email address [email protected] and an alias with [email protected]

Why do you create an alias for a domain, you do not own? What's the use case?

[engaged1]

Thank you for your reply.
I use DMS in two ways:
At first I have my own domain and the corresponding eMail-accounts are all managed via DMS.
But two users also have "old" eMail-accounts that they use and fetchmail collects all eMails form the old accounts and saves them into the same inbox as the ones from my own domain.
When I get an eMail to my old account, I want to be able to reply with the address as the original eMail was addressed to. For that reason I set up two different relayhosts in DMS. Furthermore I set an alias for each user that corresponds to each of the old eMail-addresses.

[polarathene]

Furthermore I set an alias for each user that corresponds to each of the old eMail-addresses.

• Aliases are intended for receiving mail into DMS.
• The ability use as an alias for a DMS account login is an unintentional side-effect of the Dovecot ENABLE_QUOTAS=1 (default) workaround we have in place to support the quota feature properly. Aliases should not be used for login.

So that it's clear: setup alias add my-alias@my-dms-domain real-address@anywhere

Under no circumstances should the alias be a domain that DMS does not manage. This is used as a workaround sometimes to get SPOOF_PROTECTION=1 to allow another sender address than the DMS account (setup email add my-real-account@my-dms-domain) to have permission to be used.

When you disregard this, what happens is you have told DMS that it manages that mail domain for the alias implicitly. So yahoo.tld is now considered internal. When mail is sent to an address with that mail domain, DMS will recognize it considers that managed and so sending it outbound would be pointless and it attempts to deliver it internally. Unfortunately since this is a misconfiguration, this is not correct and the delivery doesn't work as intended.

---

So really the problem here is you have SPOOF_PROTECTION=1 enabled, which is restricting your sender address choice. An alias is not how you want to relax that setting for additional sender addresses.

Please see this issue where I document the current situation. My time is limited, but I intend to have the PR fix sorted before the end of the year for the upcoming v15 DMS release. In the meantime, you can use the workaround described to add more sender addresses correctly.

[engaged1]

Hi polarathene,
very thank you for your answer in detail. Also it is great, that you changed my topic to a more specific explanation of my problem and added some proper tags, too. Great.
I'm sorry for my late answer, I was really busy in the last days.

After a long evening on wednesday I made a workaround that is working for me at the moment. I used the "user-patches.sh"-option to replace the vhost file with an individual version where only the internal domain is mentioned. It's great you even thought about a way like that to manipulate things, when someone like me missuses the usual ways DMS wants to perform the way it should. As I don't want to add more internal or external domains in the near future that solution would work for me for long (maybe not in case of an update, of course). But I will try the option you described when I have time for it. So thank you very much for your help!
DMS is really great and so is the work of you and your mates. Thank you.

Best regards, the engaged1 ;-)