I am in the planning phase of building a mailserver with the following requirements relevant to my question:
- Use postfix, virtual users (two virtual domains)
- Must filter pre-queue to reject message before it's delivered, avoiding issues with bouncing from forged/fake email addresses.
- Need to check SPF/DKIM for incoming messages, and sign outgoing email.
In order to achieve this, I thought of Postfix+amavisd, given it can work in pre-queue. Email volume won't be a problem here. Probably less than 5k messages a day. I've done this before and it works fine. The problem I'm running into here is that I'm using dkim to sign email for the first time. Going with what is familiar, and well-enough documented, I was going to use Amavisd-new to DKIM verification AND signing. However, as I understand it, it's not generally ideal to sign outgoing email pre-queue, so it has me concerned a bit. My next thought is that inbound mail should be scanned by Amavisd pre-queue, but outbound authenticated mail should go through amavisd in the more traditional after-queue setup.
A) Should I be concerned that mail is signed at this point in outbound delivery?
B) If so, is filtering outbound email after-queue achievable by simply creating a new service in master.cf for outbound mail with -o content_filter=127.0.0.1:10024? the content_filter directive in main.cf is unused.
C) If the pre-queue outbound processing for signing email is a problem, what other options do I have, if I select to not sign outbound email with amavisd?
