Update: On the advice of an IT friend, I'm running postfix on all my servers, rather than making one cloud mail server. Here's my solution so far:
# output of hostname -f - mail from local users appears to come from here
myhostname = domU-01-02-03-04-05-06.compute-1.internal
# Local delivery - include all 127.0.0.1 aliases from /etc/hosts
mydestination = $myhostname, $mydomain, rest_of_entries_from_hosts
# Needed for address translation to work
myorigin = $mydomain
# Talking to MS Online
# :submission = port 587
relayhost = [smtp.mail.microsoftonline.com]:submission
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = # Yes, leave empty
smtp_tls_security_level = encrypt
smtp_generic_maps = hash:/etc/postfix/generic
# Enable if you need debugging, but it does leak credentials to the log
#debug_peer_level = 2
#debug_peer_list = smtp.mail.microsoftonline.com
# Only listen on the local interfaces (not the public)
inet_interfaces = localhost
# I left out a bunch of CentOS defaults. postconf -n is your friend.
# These are included
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
# Run postmap /etc/postfix/sasl_passwd after editing
# Also, chown root:root; chmod 600
# Run postmap /etc/postfix/generic
# I've seen local mail come from either source
# output of dnsdomainname
# output of hostname -f
# Run newaliases after changing
# Lot of stuff here. Mostly, just make sure the graph points to root, such as
# And the important part - your email or distribution group
# Sometimes it helps to expand the name, so email comes from 'root at aws host 5'
# rather than just 'root'
root:x:0:0:root on aws host 5:/root:/bin/bash
Things I'm happy about:
- A lot of mail gets sent to root, and the one line in
alias directs who gets it.
- All mail from local users is translated to coming from
firstname.lastname@example.org, so it gets through the MS Online SMTP server.
- postfix has much better documentation than sendmail.
Things I'm not happy about:
- Custom changes are required for each host, and several steps. I wrote a bash script to help.
passwd name trick doesn't always work, and it can be difficult to figure out what server a mail is coming from.
- Every mail sent puts three warnings in the log:
warning: smtp.mail.microsoftonline.com[188.8.131.52] offered null AUTH mechanism list (SMTP server sends a null
AUTH list before
AUTH LOGIN after).
certificate verification failed for smtp.mail.microsoftonline.com: num=20:unable to get local issuer certificate (There are some config options around certs, but I'm not sure if mail delivery breaks when the cert is renewed)
certificate verification failed for smtp.mail.microsoftonline.com: num=27:certificate not trusted (Same as #2)
Thanks to the serverfault community for sharing strong opinions on mail servers.