I have a domain that uses Google Apps for mail. Now I decided to set up my own MTA (Postfix) on VPS (running Debian squeeze). There is only a very small number (less than half a dozen) of users and some of them prefer to keep using GMail web interface (and the rest of them have local Unix accounts). So I need to relay mail for certain recipients to Google SMTP servers. At first I did the following:
- Added
altmail.mydomain.org
domain alias in Google Apps. Added Postfix virtual aliases for users that want GMail:
user [email protected]
Set up transport table:
altmail.mydomain.org smtp:aspmx.l.google.com
It works, but it breaks SPF and I guess repeatedly relaying even legitimate mail this way doesn't do any good for the host reputation. The solution is to implement SRS (this seems to be rather tricky with Postfix) or simply rewrite envelope sender to fixed address like [email protected]
(I am not going to get many, if at all, bounces when delivering to valid Google Apps accounts).
But then it occurred to me that if I want to keep Google SMTP servers as backup MX records anyway, returning TEMPFAIL for certain recipients will cause any RFC-compliant sender to try the next MX record and thus deliver mail to Google without ever bothering my host to relay it. Is this a legitimate way to handle mail? How many sender MTAs are going to break because of this scheme? These recipients mostly care about mail sent from major free email services (GMail, Yahoo!, Mail.Ru etc). What is the best suited status code and enhanced status code for this situation?
Is there any way to respond with 4xx immediately after RCPT TO
other than writing a custom milter?