How to configure relay host with only supported config files?

[pierinh00d]

Hi guys. I'm a new user of docker mailserver.
I'm unable to work with relayhost setup. According to this tutorial https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/mail-forwarding/relay-hosts/#introduction RELAY* variables in env file are empty

My postfix-sasl-password.cf file:

@domain1.it <username_hidden>:<password_hidden>

and my postfix-relaymap.cf:

@domain2.it
@domain1.it [email-smtp.eu-west-1.amazonaws.com]:587
@domain3.it

But all email sent with @domain1.it aren't sent with relayhost
What am I doing wrong?
Thank you so much!

[polarathene]

RELAY* variables in env file are empty

The docs have this big mention:

In our scripts, you can see this requirement is currently required:

docker-mailserver/target/scripts/helpers/relay.sh

Lines 172 to 195 in 5efd249

	function _setup_relayhost() {
	_log 'debug' 'Setting up Postfix Relay Hosts'
	if [[ -n ${DEFAULT_RELAY_HOST} ]]; then
	_log 'trace' "Setting default relay host ${DEFAULT_RELAY_HOST}"
	postconf "relayhost = ${DEFAULT_RELAY_HOST}"
	fi
	if [[ -n ${RELAY_HOST} ]]; then
	_log 'trace' "Setting up relay hosts (default: ${RELAY_HOST})"
	_relayhost_sasl
	_populate_relayhost_map
	_relayhost_configure_postfix
	fi
	}
	function _rebuild_relayhost() {
	if [[ -n ${RELAY_HOST} ]]; then
	_relayhost_sasl
	_populate_relayhost_map
	fi
	}

You will need to create the real final configs used internally for Postfix, or enable RELAY_HOST for the DMS support to take your provided configs and create the internal ones that Postfix will use, otherwise this is skipped.

From what I can see:

• RELAY_HOST ENV will be used for any sender domain you haven't explicitly added into postfix-relaymap.cf (to exclude or assign a relay host).
• If you also set RELAY_PASSWORD, this may introduce a configuration issue if RELAY_HOST + RELAY_PORT are not configuring a valid relayhost. My advice is to consider RELAY_PASSWORD legacy and avoid setting it. Use your postfix-sasl-password.cf file only.
• Postfix does not appear to be configured with relayhost unless using the ENV DEFAULT_RELAY_HOST. However when you set RELAY_HOST, several related settings intended for relaying outbound mail are configured on the smtp transport (uses the default /etc/postfix/main.cf config) instead of the relay transport (inherits smtp config and can override via /etc/postfix/master.cf). Even without relayhost configured, these other changes may not be compatible for sending mail outbound without a relayhost destination.

Thus you can set RELAY_HOST to email-smtp.eu-west-1.amazonaws.com and RELAY_PORT to 587 and any domains you don't opt-out of via postfix-relaymap.cf would be routed through that relayhost. Similar to configuring DEFAULT_RELAY_HOST=[email-smtp.eu-west-1.amazonaws.com]:587 (except this will configure relayhost in Postfix main.cf, and lacks an opt-out AFAIK), but presently at least RELAY_HOST must always be configured regardless.

TL;DR: You could try an empty RELAY_HOST=" ", that may work. So long as you don't trigger the two conditions that would try to use it as [ ]:25.

---

Technical walk-through of current support implementation in DMS

When this feature is enabled it will set the following:

docker-mailserver/target/scripts/helpers/relay.sh

Lines 165 to 170 in 5efd249

	function _relayhost_configure_postfix() {
	postconf \
	'smtp_sasl_auth_enable = yes' \
	'smtp_sasl_security_options = noanonymous' \
	'smtp_tls_security_level = encrypt'
	}

• https://www.postfix.org/postconf.5.html#smtp_sasl_auth_enable
• https://www.postfix.org/postconf.5.html#smtp_tls_security_level

This is applying to all outbound mail from the looks of it, so DMS becomes a relayhost only and doesn't look like it supports sending mail outbound without going through a relay.

These two settings are related and at a glance imply a default configured relayhost would be used always (unless the sender_dependent_relayhost_maps overrides that):

• https://www.postfix.org/postconf.5.html#sender_dependent_relayhost_maps
• https://www.postfix.org/postconf.5.html#relayhost

I assume if relayhost is empty, it would allow you to specify only sender domains that should use a relayhost, however at least smtp_tls_security_level above might be an issue as it makes encryption mandatory which may cause problems, I've not verified.

---

Here we can see your postfix-relaymap.cf config being handled, it will copy the @domain1.it line to the real Postfix config relayhost_map:

docker-mailserver/target/scripts/helpers/relay.sh

Lines 109 to 128 in 5efd249

	function _populate_relayhost_map() {
	# Create the relayhost_map config file:
	: >/etc/postfix/relayhost_map
	chown root:root /etc/postfix/relayhost_map
	chmod 0600 /etc/postfix/relayhost_map
	# Matches lines that are not comments or only white-space:
	local MATCH_VALID='^\s*[^#[:space:]]'
	# This config is mostly compatible with `/etc/postfix/relayhost_map`, but additionally supports
	# not providing a relay host for a sender domain to opt-out of RELAY_HOST? (2nd half of function)
	if [[ -f /tmp/docker-mailserver/postfix-relaymap.cf ]]; then
	_log 'trace' "Adding relay mappings from postfix-relaymap.cf"
	# Match two values with some white-space between them (eg: `@example.test [relay.service.test]:465`):
	local MATCH_VALUE_PAIR='\S*\s+\S'
	# Copy over lines which are not a comment *and* have a destination.
	sed -n -r "/${MATCH_VALID}${MATCH_VALUE_PAIR}/p" /tmp/docker-mailserver/postfix-relaymap.cf >>/etc/postfix/relayhost_map
	fi

In that same method there is this TODO comment, that notes an improvement would be to use a default relay host, with support for opt-out of other sender domains, or the ability to adjust the transport (not implemented):

docker-mailserver/target/scripts/helpers/relay.sh

Lines 136 to 139 in 5efd249

	# TODO: Breaking change. Replace this lower half and remove the opt-out feature from `postfix-relaymap.cf`.
	# Leverage `main.cf:relayhost` for setting a default relayhost as it was prior to this feature addition.
	# Any sender domains or addresses that need to opt-out of that default relay-host can either
	# map to a different relay-host, or use a separate transport (needs feature support added).

---

For the SASL password config, you can see that it is requiring eitherRELAY_HOST or RELAY_PASSWORD is required:

docker-mailserver/target/scripts/helpers/relay.sh

Lines 60 to 68 in 5efd249

	# Responsible for `postfix-sasl-password.cf` support:
	# `/etc/postfix/sasl_passwd` example at end of file.
	function _relayhost_sasl() {
	if [[ ! -f /tmp/docker-mailserver/postfix-sasl-password.cf ]] \
	&& [[ -z ${RELAY_USER} || -z ${RELAY_PASSWORD} ]]
	then
	_log 'warn' "Missing relay-host mapped credentials provided via ENV, or from postfix-sasl-password.cf"
	return 1
	fi

There is also some parts of this script file that reference a relayhost by calling this method:

docker-mailserver/target/scripts/helpers/relay.sh

Lines 47 to 58 in 5efd249

	# NOTE: Present support has enforced wrapping the relay host with `[]` (prevents DNS MX record lookup),
	# which restricts what is supported by RELAY_HOST, although you usually do want to provide MX host directly.
	# NOTE: Present support expects to always append a port with an implicit default of `25`.
	# NOTE: DEFAULT_RELAY_HOST imposes neither restriction.
	#
	# TODO: RELAY_PORT should be optional, it will use the transport default port (`postconf smtp_tcp_port`),
	# That shouldn't be a breaking change, as long as the mapping is maintained correctly.
	# TODO: RELAY_HOST should consider dropping `[]` and require the user to include that?
	# Future refactor for _populate_relayhost_map may warrant dropping these two ENV in favor of DEFAULT_RELAY_HOST?
	function _env_relay_host() {
	echo "[${RELAY_HOST}]:${RELAY_PORT:-25}"
	}

That will use RELAY_HOST + RELAY_PORT (or default to port 25), and this seems used as a fallback:

Legacy SASL password line added if both the RELAY_* ENV are configured (not relevant when you configure postfix-sasl-password already):

docker-mailserver/target/scripts/helpers/relay.sh

Lines 86 to 89 in 5efd249

	# Add an authenticated relay host defined via ENV config:
	if [[ -n ${RELAY_USER} ]] && [[ -n ${RELAY_PASSWORD} ]]; then
	echo "$(_env_relay_host) ${RELAY_USER}:${RELAY_PASSWORD}" >> /etc/postfix/sasl_passwd
	fi

The other usage looks at your postfix-accounts.cf (setup email add ...) and postfix-virtual.cf (setup alias add ...) for sender domains to automatically configure if they weren't already handled via postfix-relaymap.cf:

docker-mailserver/target/scripts/helpers/relay.sh

Lines 149 to 160 in 5efd249

	{
	_list_domain_parts "${PRINT_DOMAIN_PART_ACCOUNTS}" /tmp/docker-mailserver/postfix-accounts.cf
	_list_domain_parts "${PRINT_DOMAIN_PART_VIRTUAL}" /tmp/docker-mailserver/postfix-virtual.cf
	} | sort -u | while read -r DOMAIN_PART; do
	# DOMAIN_PART not already present in `/etc/postfix/relayhost_map`, and not listed as a relay opt-out domain in `postfix-relaymap.cf`
	# `^@${DOMAIN_PART}\b` - To check for existing entry, the `\b` avoids accidental partial matches on similar domain parts.
	# `^\s*@${DOMAIN_PART}\s*$` - Matches line with only a domain part (eg: @example.test) to avoid including a mapping for those domains to the RELAY_HOST.
	if ! grep -q -e "^@${DOMAIN_PART}\b" /etc/postfix/relayhost_map && ! grep -qs -e "^\s*@${DOMAIN_PART}\s*$" /tmp/docker-mailserver/postfix-relaymap.cf; then
	_log 'trace' "Adding relay mapping for ${DOMAIN_PART}"
	echo "@${DOMAIN_PART} $(_env_relay_host)" >> /etc/postfix/relayhost_map
	fi
	done

Both are legacy and should not be relied on. As noted by comments, the current support is not done well:

docker-mailserver/target/scripts/helpers/relay.sh

Lines 99 to 101 in 5efd249

	# Present support uses a table lookup for sender address or domain mapping to relay-hosts,
	# Populated via `postfix-relaymap.cf `, which also features a non-standard way to exclude implicitly added internal domains from the feature.
	# It also maps all known sender domains (from configs postfix-accounts + postfix-virtual.cf) to the same ENV configured relay-host.

docker-mailserver/target/scripts/helpers/relay.sh

Lines 103 to 108 in 5efd249

	# TODO: The account + virtual config parsing and appending to /etc/postfix/relayhost_map seems to be an excessive `main.cf:relayhost`
	# implementation, rather than leveraging that for the same purpose and selectively overriding only when needed with `/etc/postfix/relayhost_map`.
	# If the issue was to opt-out select domains, if avoiding a default relay-host was not an option, then mapping those sender domains or addresses
	# to a separate transport (which can drop the `relayhost` setting) would be more appropriate.
	# TODO: With `sender_dependent_default_transport_maps`, we can extract out the excluded domains and route them through a separate transport.
	# while deprecating that support in favor of a transport config, similar to what is offered currently via sasl_passwd and relayhost_map.

---

Finally, that doc page I don't think has been updated really since it the migration from Github Wiki to the nicer docs site. There is another related ENV called DEFAULT_RELAY_HOST:

docker-mailserver/target/scripts/helpers/relay.sh

Lines 175 to 178 in 5efd249

	if [[ -n ${DEFAULT_RELAY_HOST} ]]; then
	_log 'trace' "Setting default relay host ${DEFAULT_RELAY_HOST}"
	postconf "relayhost = ${DEFAULT_RELAY_HOST}"
	fi

[polarathene]

I've opened a tracking issue for when this feature actually gets reworked: #3607

[polarathene]

My postfix-sasl-password.cf file:

@domain1.it <username_hidden>:<password_hidden>

and my postfix-relaymap.cf:

@domain1.it [email-smtp.eu-west-1.amazonaws.com]:587

But all email sent with @domain1.it aren't sent through that relayhost, what am I doing wrong?

This will be supported (no relay ENV settings required, just the relay config files) with the upcoming v14 release: #3845

However, DMS still lacks support for the regular SMTP sending without credentials when a relay host has been configured with credentials.

NOTE: Quoted content has been altered slightly, notably postfix-relaymap.cf config to omit the other domains since no opt-out for them is required.