How to configure a send-only postfix with DMS?

[loeffelpan]

Hey everybody,
I'm trying to configure a send-only mailserver. Mails should be send with smpt2go and I need port 25 open for unauthenticated sending mails. Obviously I will not publish any port to the outside. Just using it in my custom docker network with another conatiner/app in my locals network.

I tried with SMTP_ONLY=1 and ENABLE_AMAVIS=0 and hostname without any volume.
DMS comes up. But the other container is not able to send mails.

Any help would be very appreciated.

[casperklein]

PERMIT_DOCKER might be what you are looking for.

https://docker-mailserver.github.io/docker-mailserver/latest/config/environment/#permit_docker

[loeffelpan]

Thanks. I wasn't aware that there is an option to control postfix authentication.
I'll take a look.

[polarathene]

smtp2go

That is a relay service? Why would you be having mail sent to DMS to send outbound in that case? Or were you referring to something else?

Usually you can submit mail with credentials on port 465 or 587 to DMS. You should prefer that, but presently you have to configure user account yourself for SMTP_ONLY=1

You can use the PERMIT_DOCKER advice to workaround this, just know that anything that can reach DMS with that trust will be able to freely send mail. There is an open tracking issue for this feature where some of the settings don't properly configure the subnet range you might need. In your case PERMIT_DOCKER=connected-networks is probably what you want and you should be fine, but =host and =network (this one especially) are potentially more constrained if you use those.

If you're not going to have any public ports published, SMTP_ONLY=1 is only really disabling Dovecot for a mailbox, you could just not do that and add an account setup email add [email protected] and then have your app do authenticated submission instead of PERMIT_DOCKER. The DMS account from setup email add ... just happens to have an email address as the username, but you could send as whatever sender address you like.

[polarathene]

Also, we do have this example config you could reference which shows three instances of DMS all setup locally to run offline.

They are using PERMIT_DOCKER for the 2nd and 3rd DMS containers receiving mail, while the 1st is provided mail via the swaks program and uses credentials of the 1st DMS container, which will then relay through the 2nd DMS (with credentials there) and that will deliver to the third container as the destination for the recipient address.

You could have something like the 1st DMS container that relays through SMTP2Go if what I linked is what you want to use. You can skip local TLS if you'd like, or provide local TLS cert like the example shows.

[loeffelpan]

Unfortunately the app does not support submission with authentication. If so, I could send directly through smtp2go. But in my case I need a postfix instance accepting submission without authentication.

My main DMS obviously cannot do that as 25/tcp is published and would create an open relay without authentication.

For now I'm using a barely ummaintained postfix docker image for that, just to relay that mails outbound (to smtp2go). But I would like to replace it with a second lightweight DMS instance.

I think PERMIT_DOCKER would be best in my usecase.

Can I use any other ENV to make DMS running postfix only?

[polarathene]

Can I use any other ENV to make DMS running postfix only?

No, SMTP_ONLY=1 is effectively what would have been ENABLE_DOVECOT=0.

DMS uses Dovecot for user accounts, it's possible to configure Postfix with something else instead and there are some users that shared what they did in issues/discussions, but DMS doesn't have any official support for such.

Likewise, Dovecot is expected for mail storage. Postfix will still technically receive and accept some mail IIRC, and store it in /var/mail.

---

I think PERMIT_DOCKER would be best in my usecase.

Yeah, if you want to stick with DMS I guess that works 👍

---

If all you want is a service that forwards mail it receives through a relay, you probably don't need DMS?

These aren't endorsed by me, just some results of what is probably simpler, since most of these specifically focus on receiving unauthenticated and then relaying with credentials through a proper mail service (be that DMS, smtp2go, etc):

• https://github.com/decke/smtprelay
• https://github.com/grafana/smtprelay
• https://github.com/wiggin77/mailrelay
• https://github.com/axllent/mailpit

[loeffelpan]

Thank you. I will try with one of these (or similar) as well. But I'm not sure if they are maintained properly - as the postfix image I'm currently using. First two ones look promising.