Postfix won't accept submitted email for other users on virtual domain

Question

My employer has given me an email address, [email protected]. My employer's outgoing mail server only allows connections from inside their network (rather like an ISP who insists you connect through them to use their smtp server). So when I pop out to the cafe for lunch and an email from my boss arrives on my phone, I can't respond to it until I get back to the office. Also, I can't respond to work emails when I'm travelling or working in the field.

I'm not allowed to reconfigure the main mail server, but I have a small separate Postfix server which I can control. I have a number of virtual domains set up on there, and I added myemployersdomain.com as an additional virtual domain, and [email protected] as a virtual user. This works, and I can send outgoing mail through this server to anywhere in the world, EXCEPT to other users on myemployersdomain.com (which is all I really want).

When I try to send to [email protected] I get

NOQUEUE: reject: RCPT from... 550 5.1.1 ... Recipient address rejected: User unknown in virtual mailbox table

The Postfix server thinks it controls all of myemployersdomain.com, and if I don't set up a virtual user for the recipient on this domain, then it doesn't allow it. I can make the error go away by setting a catchall alias in the virtual file

@myemployersdomain.com [email protected]

but of course all the email I send then comes straight back to me!

I tried setting the transport file to relay all mail for myemployersdomain.com through, say, gmail like this:

example.com  :
myemployersdomain.com smtp:[smtp.gmail.com]:587

but it makes no difference. (The relaying works as expected for recipient addresses on other (external) domains, but for this virtual domain, Postfix doesn't allow you to get as far as this - the 5.1.1 error comes first.)

Is it possible to configure Postfix to send mail destined for a locally-defined virtual domain out into the big wide internet and let DNS sort it out?

Answer 1

If you set up your secondary machine as a backup server, you'll need a few settings.

relay_domains= myemployersdomain.com

You will also be using your transport_maps like this:

myemployersdomain.com relay:[the.actual.server]

Then you would (as Falcon says) need the relay_recipient_maps with either a wildcard entry, or an entry for you, and your boss.

Then I'd set up TLS encrypted SASL authorizaion, and allow only users who authenticate to send.

smtpd_relay_restrictions = permit_sasl_authenticated, reject

`

Answer 2

The whole point of the domain part of the email address is that it indicates which set of SMTP servers is responsible for delivery of mail for the whole domain. Put another way: you cannot subdivide domains like that.

However, it sounds like what you really want to do (besides circumventing policy, but this is an interesting question theoretically so I'm answering it anyway) is just relay mail.

In that case, you should have it relay all the mail it sees, as long as the user is authenticated. I believe you can set it up to not have a local domain at all. After all, I assume you don't actually want to have your relay MTA accept delivery of mail, and thus have two inboxes with the same address. That would just be confusing.

If you tell it to relay everything, it will send it out to whatever is in the MX record for the destination domain, which I think is what you want.

This is best accomplished by setting no local domain. That setup is common for relay MTAs that are used for virus and spam filtering, for instance.

I do recall there being a feature called relay_recipient_maps, but I don't think that is the right approach in this use case.