I setup an architecture with a PostFix mail server and an Encryption gateway.

I am relaying all my outgoing SMTP traffic (even mails going from mydomain.com to mydomain.com) to an encryption Gateway via the relay_host parameter in /etc/postfix/main.cf.

Architecture Description

Mails are reaching external users: I can for example answer mails sent by client1@mydomain.com to me@gmail.com.

The problem is that answers are not delivered to my users (due to an infinite relay loop).

This problem affects also mails sent FROM internal users TO internal users (i.e. from @mydomain.com TO @mydomain.com). This kind of traffic goes through the following itinerary: (1) Client -> (2) PostFix -> (3) Encryption Gateway -> (4) PostFix -> Encryption Gateway -> PostFix -> etc (loop). After a certain number of hops the mail is automatically deleted by the encryption gateway, i.e. NOT DELIVERED.

How can I tell PostFix not to relay mails coming from and instead direct them to Cyrus-IMAP (also hosted on ?


I think, it can not be realized in one MTA. You need to have the other MTA for send.

(2016/05/03) additional comments

I tried to enable submission port (587/TCP) in master.cf (below), as a send-only smtpd, and disabled relayhost in main.cf.

submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o myhostname=localhost
  -o mydestination=localhost
  -o local_recipient_maps=
  -o relayhost=[nnn.nnn.nnn.nnn]

When I sent a message to submission port, it entered the same queue of smtpd(25/TCP), and it was delivered to local spool (Bad result).

So, not only separate the smtpd process, we must also separate the queue and each processes (cleanup, qmgr, smtp, ..., also master). In a typical Linux distribution, I think this is difficult to achieve. But, I think that can be achieved in combination with postfix (25/TCP, spool) and another MTA (587/TCP, send-only, e.g. sendmail).

  • That's what I am going to do. It is hard also to tell PostFix (giving my current needs) to relay incoming SMTP traffic from to cyrus-imap. – Fethi Dilmi May 5 '16 at 10:19
  • and whats wrong with standart queue? it has nothing to do with the next hop. you are thinking the right way (additional service with relayhost), but somehow bad implementation – Darigaaz May 5 '16 at 12:21
  • i think you need additional relay_domains=mydomain.com and empty mydestination options in submission service – Darigaaz May 5 '16 at 12:27
  • @Darigaaz: Thank you for your comments. There is no information of the next-hop in the queued message. qmgr or trivial-rewrite determine the next-hop. smtpd don't. – Taichi Yanagiya May 5 '16 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.