I have a domain that uses Google Apps for mail. Now I decided to set up my own MTA (Postfix) on VPS (running Debian squeeze). There is only a very small number (less than half a dozen) of users and some of them prefer to keep using GMail web interface (and the rest of them have local Unix accounts). So I need to relay mail for certain recipients to Google SMTP servers. At first I did the following:

  • Added altmail.mydomain.org domain alias in Google Apps.
  • Added Postfix virtual aliases for users that want GMail:

    user user@altmail.mydomain.org

  • Set up transport table:

    altmail.mydomain.org smtp:aspmx.l.google.com

It works, but it breaks SPF and I guess repeatedly relaying even legitimate mail this way doesn't do any good for the host reputation. The solution is to implement SRS (this seems to be rather tricky with Postfix) or simply rewrite envelope sender to fixed address like postmaster@mydomain.org (I am not going to get many, if at all, bounces when delivering to valid Google Apps accounts).

But then it occurred to me that if I want to keep Google SMTP servers as backup MX records anyway, returning TEMPFAIL for certain recipients will cause any RFC-compliant sender to try the next MX record and thus deliver mail to Google without ever bothering my host to relay it. Is this a legitimate way to handle mail? How many sender MTAs are going to break because of this scheme? These recipients mostly care about mail sent from major free email services (GMail, Yahoo!, Mail.Ru etc). What is the best suited status code and enhanced status code for this situation?

Is there any way to respond with 4xx immediately after RCPT TO other than writing a custom milter?


Well, in case anyone is interested:

Yes, it's possible to implement this scheme without writing any milters: just use check_recipient_access with any custom response codes and messages in access(5) table.

And no, it doesn't work. At least GMail retries the highest priority MX over and over when it sees 4xx error instead of trying the next one. For now I ended up with rewriting envelope sender addresses with pcre type canonical table to postmaster@mydomain.org.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.