Archive-Team
/
docker-mailserver
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

deploy: d426f724cd

This commit is contained in:
github-actions[bot] 2024-01-31 10:11:49 +00:00
parent cf8ca8133a
commit 81b10ff66c
5 changed files with 257 additions and 182 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
edge/config/advanced/mail-forwarding/aws-ses/index.html
View File

@ -2028,23 +2028,38 @@
<h1>AWS SES</h1>
<p><a href="https://aws.amazon.com/ses/">Amazon SES (Simple Email Service)</a> is intended to provide a simple way for cloud based applications to send email and receive email. For the purposes of this project only sending email via SES is supported. Older versions of docker-mailserver used <code>AWS_SES_HOST</code> and <code>AWS_SES_USERPASS</code> to configure sending, this has changed and the setup is managed through <a href="../relay-hosts/">Configure Relay Hosts</a>.</p>
<p>You will need to create some <a href="https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html">Amazon SES SMTP credentials</a>. The SMTP credentials you create will be used to populate the <code>RELAY_USER</code> and <code>RELAY_PASSWORD</code> environment variables.</p>
<p>The <code>RELAY_HOST</code> should match your <a href="https://docs.aws.amazon.com/general/latest/gr/ses.html">AWS SES region</a>, the <code>RELAY_PORT</code> will be 587.</p>
<p>If all of your email is being forwarded through AWS SES, <code>DEFAULT_RELAY_HOST</code> should be set accordingly.</p>
<p>Example:
<div class="highlight"><pre><span></span><code>DEFAULT_RELAY_HOST=[email-smtp.us-west-2.amazonaws.com]:587
</code></pre></div></p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>If you set up <a href="https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-authentication-dkim-easy.html">AWS Easy DKIM</a> you can safely skip setting up DKIM as the AWS SES will take care of signing your outgoing email.</p>
</div>
<p>To verify proper operation, send an email to some external account of yours and inspect the mail headers. You will also see the connection to SES in the mail logs. For example:</p>
<div class="highlight"><pre><span></span><code><span class="go">May 23 07:09:36 mail postfix/smtp[692]: Trusted TLS connection established to email-smtp.us-east-1.amazonaws.com[107.20.142.169]:25:</span>
<span class="go">TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)</span>
<span class="go">May 23 07:09:36 mail postfix/smtp[692]: 8C82A7E7: to=&lt;someone@example.com&gt;, relay=email-smtp.us-east-1.amazonaws.com[107.20.142.169]:25,</span>
<span class="go">delay=0.35, delays=0/0.02/0.13/0.2, dsn=2.0.0, status=sent (250 Ok 01000154dc729264-93fdd7ea-f039-43d6-91ed-653e8547867c-000000)</span>
<p><a href="https://aws.amazon.com/ses/">Amazon SES (Simple Email Service)</a> provides a simple way for cloud based applications to send and receive email.</p>
<div class="admonition example">
<p class="admonition-title">Configuration via ENV</p>
<p><a href="../relay-hosts/">Configure a relay host in DMS</a> to forward all your mail through AWS SES:</p>
<ul>
<li><code>RELAY_HOST</code> should match your <a href="https://docs.aws.amazon.com/general/latest/gr/ses.html">AWS SES region</a>.</li>
<li><code>RELAY_PORT</code> should be set to <a href="https://docs.aws.amazon.com/ses/latest/dg/smtp-connect.html">one of the supported AWS SES SMTP ports</a> (<em>eg: 587 for STARTTLS</em>).</li>
<li><code>RELAY_USER</code> and <code>RELAY_PASSWORD</code> should be set to your <a href="https://docs.aws.amazon.com/ses/latest/dg/smtp-credentials.html">Amazon SES SMTP credentials</a>.</li>
</ul>
<div class="highlight"><pre><span></span><code><span class="na">RELAY_HOST</span><span class="o">=</span><span class="s">email-smtp.us-west-2.amazonaws.com</span>
<span class="na">RELAY_PORT</span><span class="o">=</span><span class="s">587</span>
<span class="c1"># Alternative to RELAY_HOST + RELAY_PORT which is compatible with LDAP:</span>
<span class="na">DEFAULT_RELAY_HOST</span><span class="o">=</span><span class="s">[email-smtp.us-west-2.amazonaws.com]:587</span>
<span class="na">RELAY_USER</span><span class="o">=</span><span class="s">aws-user</span>
<span class="na">RELAY_PASSWORD</span><span class="o">=</span><span class="s">secret</span>
</code></pre></div>
</div>
<div class="admonition tip">
<p class="admonition-title">Tip</p>
<p>If you have set up <a href="https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-authentication-dkim-easy.html">AWS Easy DKIM</a>, you can safely skip setting up DKIM as AWS SES will take care of signing your outbound mail.</p>
</div>
<div class="admonition note">
<p class="admonition-title">Verify the relay host is configured correctly</p>
<p>To verify proper operation, send an email to some external account of yours and inspect the mail headers.</p>
<p>You will also see the connection to SES in the mail logs:</p>
<div class="highlight"><pre><span></span><code><span class="go">postfix/smtp[692]: Trusted TLS connection established to email-smtp.us-west-1.amazonaws.com[107.20.142.169]:25:</span>
<span class="go"> TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)</span>
<span class="go">postfix/smtp[692]: 8C82A7E7: to=&lt;someone@example.com&gt;, relay=email-smtp.us-west-1.amazonaws.com[107.20.142.169]:25,</span>
<span class="go"> delay=0.35, delays=0/0.02/0.13/0.2, dsn=2.0.0, status=sent (250 Ok 01000154dc729264-93fdd7ea-f039-43d6-91ed-653e8547867c-000000)</span>
</code></pre></div>
</div>

236
edge/config/advanced/mail-forwarding/relay-hosts/index.html
View File

@ -80,7 +80,7 @@
<div data-md-component="skip">
<a href="#introduction" class="md-skip">
<a href="#what-is-a-relay-host" class="md-skip">
Skip to content
</a>
@ -1330,22 +1330,23 @@
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#introduction" class="md-nav__link">
<a href="#what-is-a-relay-host" class="md-nav__link">
<span class="md-ellipsis">
Introduction
What is a Relay Host?
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#basic-configuration" class="md-nav__link">
<a href="#configuration" class="md-nav__link">
<span class="md-ellipsis">
Basic Configuration
Configuration
</span>
</a>
</li>
<nav class="md-nav" aria-label="Configuration">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#advanced-configuration" class="md-nav__link">
@ -1354,31 +1355,12 @@
</span>
</a>
<nav class="md-nav" aria-label="Advanced Configuration">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#sender-dependent-authentication" class="md-nav__link">
<span class="md-ellipsis">
Sender-dependent Authentication
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#sender-dependent-relay-host" class="md-nav__link">
<a href="#technical-details" class="md-nav__link">
<span class="md-ellipsis">
Sender-dependent Relay Host
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#excluding-sender-domains" class="md-nav__link">
<span class="md-ellipsis">
Excluding Sender Domains
Technical Details
</span>
</a>
@ -2097,22 +2079,23 @@
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#introduction" class="md-nav__link">
<a href="#what-is-a-relay-host" class="md-nav__link">
<span class="md-ellipsis">
Introduction
What is a Relay Host?
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#basic-configuration" class="md-nav__link">
<a href="#configuration" class="md-nav__link">
<span class="md-ellipsis">
Basic Configuration
Configuration
</span>
</a>
</li>
<nav class="md-nav" aria-label="Configuration">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#advanced-configuration" class="md-nav__link">
@ -2121,31 +2104,12 @@
</span>
</a>
<nav class="md-nav" aria-label="Advanced Configuration">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#sender-dependent-authentication" class="md-nav__link">
<span class="md-ellipsis">
Sender-dependent Authentication
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#sender-dependent-relay-host" class="md-nav__link">
<a href="#technical-details" class="md-nav__link">
<span class="md-ellipsis">
Sender-dependent Relay Host
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#excluding-sender-domains" class="md-nav__link">
<span class="md-ellipsis">
Excluding Sender Domains
Technical Details
</span>
</a>
@ -2189,59 +2153,135 @@
<h1>Relay Hosts</h1>
<h2 id="introduction"><a class="toclink" href="#introduction">Introduction</a></h2>
<p>Rather than having Postfix deliver mail directly, you can configure Postfix to send mail via another mail relay (smarthost). Examples include <a href="https://www.mailgun.com/">Mailgun</a>, <a href="https://sendgrid.com/">Sendgrid</a> and <a href="https://aws.amazon.com/ses/">AWS SES</a>.</p>
<p>Depending on the domain of the sender, you may want to send via a different relay, or authenticate in a different way.</p>
<h2 id="basic-configuration"><a class="toclink" href="#basic-configuration">Basic Configuration</a></h2>
<p>Basic configuration is done via environment variables:</p>
<h2 id="what-is-a-relay-host"><a class="toclink" href="#what-is-a-relay-host">What is a Relay Host?</a></h2>
<p>An SMTP relay service (<em>aka relay host / <a href="https://en.wikipedia.org/wiki/Smart_host">smarthost</a></em>) is an MTA that relays (<em>forwards</em>) mail on behalf of third-parties (<em>it does not manage the mail domains</em>).</p>
<ul>
<li><code>RELAY_HOST</code>: <em>default host to relay mail through, <code>empty</code> (aka '', or no ENV set) will disable this feature</em></li>
<li><code>RELAY_PORT</code>: <em>port on default relay, defaults to port 25</em></li>
<li><code>RELAY_USER</code>: <em>username for the default relay</em></li>
<li><code>RELAY_PASSWORD</code>: <em>password for the default user</em></li>
<li>Instead of DMS handling SMTP delivery directly itself (<em>via Postfix</em>), it can be configured to delegate delivery by sending all outbound mail through a relay service.</li>
<li>Examples of popular mail relay services: <a href="https://aws.amazon.com/ses/">AWS SES</a>, <a href="https://www.mailgun.com/">Mailgun</a>, <a href="https://www.mailjet.com">Mailjet</a>, <a href="https://sendgrid.com/">SendGrid</a></li>
</ul>
<div class="admonition info">
<p class="admonition-title">When can a relay service can be helpful?</p>
<ul>
<li>Your network provider has blocked outbound connections on port 25 (<em>required for direct delivery</em>).</li>
<li>To improve delivery success via better established reputation (trust) of a relay service.</li>
</ul>
</div>
<h2 id="configuration"><a class="toclink" href="#configuration">Configuration</a></h2>
<p>All mail sent outbound from DMS (<em>where the sender address is a DMS account or a virtual alias</em>) will be relayed through the configured relay host.</p>
<div class="admonition info">
<p class="admonition-title">Configuration via ENV</p>
<p>Configure the default relayhost with either of these ENV:</p>
<ul>
<li>Preferable (<em>LDAP compatible</em>): <code>DEFAULT_RELAY_HOST</code> (eg: <code>[mail.relay-service.com]:25</code>)</li>
<li><code>RELAY_HOST</code> (eg: <code>mail.relay-service.com</code>) + <code>RELAY_PORT</code> (default: 25)</li>
</ul>
<p>Most relay services also require authentication configured:</p>
<ul>
<li><code>RELAY_USER</code> + <code>RELAY_PASSWORD</code> provides credentials for authenticating with the default relayhost.</li>
</ul>
<p>Setting these environment variables will cause mail for all sender domains to be routed via the specified host, authenticating with the user/password combination.</p>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>For users of the previous <code>AWS_SES_*</code> variables: please update your configuration to use these new variables, no other configuration is required.</p>
<p class="admonition-title">Providing secrets via ENV</p>
<p>While ENV is convenient, the risk of exposing secrets is higher.</p>
<p><code>setup relay add-auth</code> is a better alternative, which manages the credentials via a config file.</p>
</div>
<h2 id="advanced-configuration"><a class="toclink" href="#advanced-configuration">Advanced Configuration</a></h2>
<h3 id="sender-dependent-authentication"><a class="toclink" href="#sender-dependent-authentication">Sender-dependent Authentication</a></h3>
<p>Sender dependent authentication is done in <code>docker-data/dms/config/postfix-sasl-password.cf</code>. You can create this file manually, or use:</p>
<div class="highlight"><pre><span></span><code>setup.sh<span class="w"> </span>relay<span class="w"> </span>add-auth<span class="w"> </span>&lt;domain&gt;<span class="w"> </span>&lt;username&gt;<span class="w"> </span><span class="o">[</span>&lt;password&gt;<span class="o">]</span>
</code></pre></div>
<p>An example configuration file looks like this:</p>
<div class="highlight"><pre><span></span><code>@domain1.com relay_user_1:password_1
@domain2.com relay_user_2:password_2
</code></pre></div>
<p>If there is no other configuration, this will cause Postfix to deliver email through the relay specified in <code>RELAY_HOST</code> env variable, authenticating as <code>relay_user_1</code> when sent from <code>domain1.com</code> and authenticating as <code>relay_user_2</code> when sending from <code>domain2.com</code>.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>To activate the configuration you must either restart the container, or you can also trigger an update by modifying a mail account.</p>
</div>
<h3 id="sender-dependent-relay-host"><a class="toclink" href="#sender-dependent-relay-host">Sender-dependent Relay Host</a></h3>
<p>Sender dependent relay hosts are configured in <code>docker-data/dms/config/postfix-relaymap.cf</code>. You can create this file manually, or use:</p>
<div class="highlight"><pre><span></span><code>setup.sh<span class="w"> </span>relay<span class="w"> </span>add-domain<span class="w"> </span>&lt;domain&gt;<span class="w"> </span>&lt;host&gt;<span class="w"> </span><span class="o">[</span>&lt;port&gt;<span class="o">]</span>
</code></pre></div>
<p>An example configuration file looks like this:</p>
<div class="highlight"><pre><span></span><code>@domain1.com [relay1.org]:587
@domain2.com [relay2.org]:2525
</code></pre></div>
<p>Combined with the previous configuration in <code>docker-data/dms/config/postfix-sasl-password.cf</code>, this will cause Postfix to deliver mail sent from <code>domain1.com</code> via <code>relay1.org:587</code>, authenticating as <code>relay_user_1</code>, and mail sent from <code>domain2.com</code> via <code>relay2.org:2525</code> authenticating as <code>relay_user_2</code>.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>You still have to define <code>RELAY_HOST</code> to activate the feature</p>
<details class="tip">
<summary>Excluding specific sender domains from relay</summary>
<p>You can opt-out with: <code>setup relay exclude-domain &lt;domain&gt;</code></p>
<p>Outbound mail from senders of that domain will be sent normally (<em>instead of through the configured <code>RELAY_HOST</code></em>).</p>
<div class="admonition warning">
<p class="admonition-title">When any relay host credentials are configured</p>
<p>It will still be expected that mail is sent over a secure connection with credentials provided.</p>
<p>Thus this opt-out feature is rarely practical.</p>
</div>
<h3 id="excluding-sender-domains"><a class="toclink" href="#excluding-sender-domains">Excluding Sender Domains</a></h3>
<p>If you want mail sent from some domains to be delivered directly, you can exclude them from being delivered via the default relay by adding them to <code>docker-data/dms/config/postfix-relaymap.cf</code> with no destination. You can also do this via:</p>
<div class="highlight"><pre><span></span><code>setup.sh<span class="w"> </span>relay<span class="w"> </span>exclude-domain<span class="w"> </span>&lt;domain&gt;
</details>
<h3 id="advanced-configuration"><a class="toclink" href="#advanced-configuration">Advanced Configuration</a></h3>
<p>When mail is sent, there is support to change the relay service or the credentials configured based on the sender address domain used.</p>
<p>We provide this support via two config files:</p>
<ul>
<li>Sender-dependent Relay Host: <code>docker-data/dms/config/postfix-relaymap.cf</code></li>
<li>Sender-dependent Authentication: <code>docker-data/dms/config/postfix-sasl-password.cf</code></li>
</ul>
<div class="admonition tip">
<p class="admonition-title">Configure with our <code>setup relay</code> commands</p>
<p>While you can edit those configs directly, DMS provides these helpful config management commands:</p>
<div class="highlight"><pre><span></span><code><span class="c"># Configure a sender domain to use a specific relay host:</span>
setup relay add-domain <span class="s">&lt;domain&gt; &lt;host&gt; [&lt;port&gt;]</span>
<span class="c"># Configure relay host credentials for a sender domain to use:</span>
setup relay add-auth <span class="s">&lt;domain&gt; &lt;username&gt; [&lt;password&gt;]</span>
<span class="c"># Optionally avoid relaying from senders of this domain:</span>
<span class="c"># NOTE: Only supported when configured with the `RELAY_HOST` ENV!</span>
setup relay exclude-domain <span class="s">&lt;domain&gt;</span>
</code></pre></div>
<p>Extending the configuration file from above:</p>
<div class="highlight"><pre><span></span><code>@domain1.com [relay1.org]:587
@domain2.com [relay2.org]:2525
@domain3.com
</div>
<div class="admonition example">
<p class="admonition-title">Config file: <code>postfix-sasl-password.cf</code></p>
<div class="highlight"><span class="filename">docker-data/dms/config/postfix-sasl-password.cf</span><pre><span></span><code><span class="s">@domain1.com mailgun-user</span><span class="p">:</span>secret
<span class="s">@domain2.com sendgrid-user</span><span class="p">:</span>secret
<span class="c"># NOTE: This must have an exact match with the relay host in `postfix-relaymap.cf`,</span>
<span class="c"># `/etc/postfix/relayhost_map`, or the `DEFAULT_RELAY_HOST` ENV.</span>
<span class="c"># NOTE: Not supported via our setup CLI, but valid config for Postfix.</span>
<span class="s">[email-smtp.us-west-2.amazonaws.com]</span><span class="p">:</span><span class="m">2587</span> aws-user<span class="p">:</span>secret
</code></pre></div>
<p>This will cause email sent from <code>domain3.com</code> to be delivered directly.</p>
<p>When Postfix needs to lookup credentials for mail sent outbound, the above config will:</p>
<ul>
<li>Authenticate as <code>mailgun-user</code> for mail sent with a sender belonging to <code>@domain1.com</code></li>
<li>Authenticate as <code>sendgrid-user</code> for mail sent with a sender belonging to <code>@domain2.com</code></li>
<li>Authenticate as <code>aws-user</code> for mail sent through a configured AWS SES relay host (any sender domain).</li>
</ul>
</div>
<div class="admonition example">
<p class="admonition-title">Config file: <code>postfix-relaymap.cf</code></p>
<div class="highlight"><span class="filename">docker-data/dms/config/postfix-relaymap.cf</span><pre><span></span><code><span class="s">@domain1.com [smtp.mailgun.org]</span><span class="p">:</span><span class="m">587</span>
<span class="s">@domain2.com [smtp.sendgrid.net]</span><span class="p">:</span><span class="m">2525</span>
<span class="c"># Opt-out of relaying:</span>
<span class="s">@domain3.com</span>
</code></pre></div>
<p>When Postfix sends mail outbound from these sender domains, the above config will:</p>
<ul>
<li>Relay mail through <code>[smtp.mailgun.org]:587</code> when mail is sent from a sender of <code>@domain1.com</code></li>
<li>Relay mail through <code>[smtp.sendgrid.net]:2525</code> when mail is sent from a sender of <code>@domain1.com</code></li>
<li>Mail with a sender from <code>@domain3.com</code> is not sent through a relay (<em><strong>Only applicable</strong> when using <code>RELAY_HOST</code></em>)</li>
</ul>
</div>
<h3 id="technical-details"><a class="toclink" href="#technical-details">Technical Details</a></h3>
<ul>
<li>Both the supported ENV and config files for this feature have additional details covered in our ENV docs <a href="../../../environment/#relay-host">Relay Host section</a>.</li>
<li>For troubleshooting, a <a href="https://github.com/docker-mailserver/docker-mailserver/issues/3842#issuecomment-1913380639">minimal <code>compose.yaml</code> config with several DMS instances</a> demonstrates this feature for local testing.</li>
<li><a href="https://github.com/docker-mailserver/docker-mailserver/issues/3607">Subscribe to this tracking issue</a> for future improvements intended for this feature.</li>
</ul>
<div class="admonition abstract">
<p class="admonition-title">Postfix Settings</p>
<p>Internally this feature is implemented in DMS by <a href="https://github.com/docker-mailserver/docker-mailserver/blob/v14.0.0/target/scripts/helpers/relay.sh"><code>relay.sh</code></a>.</p>
<p>The <code>relay.sh</code> script manages configuring these Postfix settings:</p>
<div class="highlight"><pre><span></span><code><span class="c"># Send all outbound mail through this relay service:</span>
relayhost <span class="s">= [smtp.relay-service.com]</span><span class="p">:</span><span class="m">587</span>
<span class="c"># Credentials to use:</span>
smtp_sasl_password_maps <span class="s">= texthash</span><span class="p">:</span><span class="s">/etc/postfix/sasl_passwd</span>
<span class="c"># Alternative table type examples which do not require a separate file:</span>
<span class="c">#smtp_sasl_password_maps = static:john.doe@relay-service.com:secret</span>
<span class="c">#smtp_sasl_password_maps = inline:{ [smtp.relay-service.com]:587=john.doe@relay-service.com:secret }</span>
<span class="c">## Authentication support:</span>
<span class="c"># Required to provide credentials to the relay service:</span>
smtp_sasl_auth_enable <span class="s">= yes</span>
<span class="c"># Enforces requiring credentials when sending mail outbound:</span>
smtp_sasl_security_options <span class="s">= noanonymous</span>
<span class="c"># Enforces a secure connection (TLS required) to the relay service:</span>
smtp_tls_security_level <span class="s">= encrypt</span>
<span class="c">## Support for advanced requirements:</span>
<span class="c"># Relay service(s) to use instead of direct delivery for specific sender domains:</span>
sender_dependent_relayhost_maps <span class="s">= texthash</span><span class="p">:</span><span class="s">/etc/postfix/relayhost_map</span>
<span class="c"># Support credentials to a relay service(s) that vary by relay host used or sender domain:</span>
smtp_sender_dependent_authentication <span class="s">= yes</span>
</code></pre></div>
</div>

52
edge/config/environment/index.html
View File

@ -5647,13 +5647,16 @@ you to replace both instead of just the envelope sender.</p>
<li>Set this if auto-detection fails, isn't what you want, or you wish to have a separate container handle DSNs</li>
</ul>
<h4 id="relay-host"><a class="toclink" href="#relay-host">Relay Host</a></h4>
<div class="admonition tip">
<p class="admonition-title"><code>RELAY_HOST</code> vs <code>DEFAULT_RELAY_HOST</code></p>
<p><code>DEFAULT_RELAY_HOST</code> is encouraged, but presently does not support sender domain opt-out (<code>setup relay exclude-domain</code>).</p>
<p>Supported ENV for the <a href="../advanced/mail-forwarding/relay-hosts/">Relay Host</a> feature.</p>
<div class="admonition note">
<p class="admonition-title">Prefer <code>DEFAULT_RELAY_HOST</code> instead of <code>RELAY_HOST</code></p>
<p>This is advised unless you need support for sender domain opt-out (via <code>setup relay exclude-domain</code>).</p>
<p>The implementation for <code>RELAY_HOST</code> is not compatible with LDAP.</p>
</div>
<div class="admonition tip">
<p class="admonition-title">Opt-in for relay host support</p>
<p>If you only want to enable relay for specific sender domains, use can use opt-in via <code>setup relay add-domain</code>.</p>
<p>Enable relaying only for specific sender domains instead by using <code>setup relay add-domain</code>.</p>
<p><strong>NOTE:</strong> Presently there is a caveat when relay host credentials are configured (<em>which is incompatible with opt-in</em>).</p>
</div>
<h5 id="default_relay_host"><a class="toclink" href="#default_relay_host">DEFAULT_RELAY_HOST</a></h5>
<p>Configures a default relay host.</p>
@ -5666,22 +5669,25 @@ you to replace both instead of just the envelope sender.</p>
</div>
<div class="admonition abstract">
<p class="admonition-title">Technical Details</p>
<p>Configures the Postfix <code>main.cf</code> setting: <a href="https://www.postfix.org/postconf.5.html#relayhost"><code>relayhost</code></a></p>
<p>This ENV internally configures the Postfix <code>main.cf</code> setting: <a href="https://www.postfix.org/postconf.5.html#relayhost"><code>relayhost</code></a></p>
</div>
<h5 id="relay_host"><a class="toclink" href="#relay_host">RELAY_HOST</a></h5>
<p>Configures a default relay host.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Expects a value like <code>mail.example.com</code>. Internally this will be wrapped to <code>[mail.example.com]</code>, so it should resolve to the MTA directly.</p>
<div class="admonition warning">
<p class="admonition-title">Do not use with <code>DEFAULT_RELAY_HOST</code></p>
<p><code>RELAY_HOST</code> has precedence as it is configured with <code>sender_dependent_relayhost_maps</code>.</p>
</div>
</div>
<div class="admonition info">
<p class="admonition-title">Info</p>
<ul>
<li>This is a legacy ENV. It is however required for the opt-out feature of <code>postfix-relaymap.cf</code> to work.</li>
<li>When configured, all known mail domains managed by DMS will be configured to relay outbound mail, just like <code>DEFAULT_RELAY_HOST</code>.</li>
<li>Internal configuration however differs from <code>DEFAULT_RELAY_HOST</code>.</li>
</ul>
</div>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Expects a value like <code>mail.example.com</code>. Internally this will be wrapped to <code>[mail.example.com]</code>, so it should resolve to the MTA directly.</p>
<p>Do not use with <code>DEFAULT_RELAY_HOST</code>. <code>RELAY_HOST</code> has precedence as it is configured with <code>sender_dependent_relayhost_maps</code>.</p>
</div>
<div class="admonition abstract">
<p class="admonition-title">Technical Details</p>
<p>This feature is configured internally using the:</p>
@ -5689,6 +5695,7 @@ you to replace both instead of just the envelope sender.</p>
<li>Postfix setting with config: <a href="https://www.postfix.org/postconf.5.html#sender_dependent_relayhost_maps"><code>sender_dependent_relayhost_maps = texthash:/etc/postfix/relayhost_map</code></a></li>
<li>DMS Config volume support via: <code>postfix-relaymap.cf</code> (<em>generates <code>/etc/postfix/relayhost_map</code></em>)</li>
</ul>
<p>All known mail domains managed by DMS will be configured to relay outbound mail to <code>RELAY_HOST</code> by adding them implicitly to <code>/etc/postfix/relayhost_map</code>, except for domains using the opt-out feature of <code>postfix-relaymap.cf</code>.</p>
</div>
<h5 id="relay_port"><a class="toclink" href="#relay_port">RELAY_PORT</a></h5>
<p>Default =&gt; 25</p>
@ -5699,7 +5706,7 @@ you to replace both instead of just the envelope sender.</p>
</div>
<h4 id="relay-host-credentials"><a class="toclink" href="#relay-host-credentials">Relay Host Credentials</a></h4>
<div class="admonition warning">
<p class="admonition-title">Configuring relay host credentials make outbound authentication mandatory</p>
<p class="admonition-title">Configuring relay host credentials enforces outbound authentication</p>
<p>Presently when <code>RELAY_USER</code> + <code>RELAY_PASSWORD</code> or <code>postfix-sasl-password.cf</code> are configured, all outbound mail traffic is configured to require a secure connection established and forbids the omission of credentials.</p>
<p>Additional feature work is required to only enforce these requirements on mail sent through a configured relay host.</p>
</div>
@ -5708,10 +5715,10 @@ you to replace both instead of just the envelope sender.</p>
<p>Provide the credentials to use with <code>RELAY_HOST</code> or <code>DEFAULT_RELAY_HOST</code>.</p>
<div class="admonition tip">
<p class="admonition-title">Alternative credentials config</p>
<p>You may prefer to use <code>setup relay add-auth</code> to avoid exposure of secrets in ENV.</p>
<p>You may prefer to use <code>setup relay add-auth</code> to avoid risking ENV exposing secrets.</p>
<ul>
<li>With the CLI command you must provide each sender domain relay credentials.</li>
<li>Alternatively manually edit <code>postfix-sasl-password.cf</code> with the correct relayhost entry (<em><code>DEFAULT_RELAY_HOST</code> value or as defined in <code>/etc/postfix/relayhost_map</code></em>) to provide credentials per relayhost configured.</li>
<li>With the CLI command, you must provide relay credentials for each of your sender domains.</li>
<li>Alternatively manually edit <code>postfix-sasl-password.cf</code> with the correct relayhost entry (<em><code>DEFAULT_RELAY_HOST</code> value, or as defined in <code>/etc/postfix/relayhost_map</code></em>) to provide credentials per relayhost configured.</li>
</ul>
</div>
<div class="admonition abstract">
@ -5721,7 +5728,20 @@ you to replace both instead of just the envelope sender.</p>
<li>Postfix setting with config: <a href="https://www.postfix.org/postconf.5.html#smtp_sasl_password_maps"><code>smtp_sasl_password_maps = texthash:/etc/postfix/sasl_passwd</code></a></li>
<li>DMS Config volume support via: <code>postfix-sasl-password.cf</code> (<em>generates <code>/etc/postfix/sasl_passwd</code></em>)</li>
</ul>
<p>This file has relay hosts that must match the <code>host:port</code> of <code>/etc/postfix/relayhost_map</code> or <code>main.cf:relayhost</code>. DMS support handles this for you.</p>
<hr />
<p>When <code>postfix-sasl-password.cf</code> is present, DMS will copy it internally to <code>/etc/postfix/sasl_passwd</code>.</p>
<ul>
<li>DMS provides support for mapping credentials by sender domain:<ul>
<li>Explicitly via <code>setup relay add-auth</code> (<em>creates / updates <code>postfix-sasl-password.cf</code></em>).</li>
<li>Implicitly via the relay ENV support (<em>configures all known DMS managed domains to use the relay ENV</em>).</li>
</ul>
</li>
<li>Credentials can be explicitly configured for specific relay hosts instead of sender domains:<ul>
<li>Add the exact relayhost value (<code>host:port</code> / <code>[host]:port</code>) from the generated <code>/etc/postfix/relayhost_map</code>, or <code>main.cf:relayhost</code> (<code>DEFAULT_RELAY_HOST</code>).</li>
<li><code>setup relay ...</code> is missing support, you must instead add these manually to <code>postfix-sasl-password.cf</code>.</li>
</ul>
</li>
</ul>
</div>

2
edge/search/search_index.json
View File

File diff suppressed because one or more lines are too long

94
edge/sitemap.xml
View File

@ -2,237 +2,237 @@
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/faq/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/introduction/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/usage/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/debugging/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/environment/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/pop3/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/setup.sh/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/user-management/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/auth-ldap/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/auth-oauth2/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/dovecot-master-accounts/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/full-text-search/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/ipv6/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/kubernetes/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/mail-fetchmail/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/mail-getmail/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/mail-sieve/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/optional-config/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/podman/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/mail-forwarding/aws-ses/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/mail-forwarding/relay-hosts/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/maintenance/update-and-cleanup/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/override-defaults/dovecot/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/override-defaults/postfix/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/override-defaults/user-patches/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/best-practices/autodiscover/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/best-practices/dkim_dmarc_spf/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/best-practices/mta-sts/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/security/fail2ban/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/security/mail_crypt/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/security/rspamd/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/security/ssl/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/config/security/understanding-the-ports/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/contributing/general/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/contributing/issues-and-pull-requests/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/contributing/tests/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/tutorials/basic-installation/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/tutorials/blog-posts/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/tutorials/crowdsec/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/tutorials/docker-build/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/tutorials/mailserver-behind-proxy/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/use-cases/auth-lua/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/use-cases/bind-smtp-network-interface/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/use-cases/forward-only-mailserver-with-ldap-authentication/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/use-cases/imap-folders/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>https://docker-mailserver.github.io/docker-mailserver/edge/examples/use-cases/ios-mail-push-support/</loc>
<lastmod>2024-01-30</lastmod>
<lastmod>2024-01-31</lastmod>
<changefreq>daily</changefreq>
</url>
</urlset>