I'm looking for options of how to setup a reverse proxy for a mail server. Very similar to how apache can reverse proxy web traffic to hide the source of the web content, I want to hide the source of the mail server. I know this is an odd request, however it is definitely what I need.

  • In reception or send ? If for reception, why you just don't point your MX to a public antispam product, that itself send you back all the mail. You change your router to accept only traffic coming from that server. In send, use a smarthost ? – yagmoth555 Aug 18 '16 at 3:13
  • Primarily for receiving, sending would just be a nice bonus. Having all domains pointed to the same product would be a footprint I have to avoid. – Moonstone Aug 18 '16 at 3:28
  • campus.barracuda.com/product/emailsecuritygateway/article/BSF/… ? or similar product exist, thus remote sender never actually talk to your mail server – yagmoth555 Aug 18 '16 at 3:43
  • There's no SMTP equivalent of SNI. You won't be able to do this without running one server (or at least daemon) per domain. You will need as many IP addresses as domains. SMTP doesn't use SRV records and MX records don't have port indicators. – 84104 Aug 18 '16 at 3:47

I don't believe a proxy is what you need. Though if you must look into something proxy, there's a generic type of proxy called socks - google it. A web proxy will not work. Socks is... well, don't do it. Keep reading.

If you really want to hide your mail server you need to relay through another mail server, and modify your message headers.

There are many public mail relay services that you can pay for.

Incoming mail -> 3rd party relay -> your SMTP server -> destination

Outgoing mail -> your SMTP server -> 3rd party relay -> destination

The problem is with outbound mail, usually mail headers would contain things like this and you're smtp server would be listed as one of the "received" servers.

Received: from BAY169-W26 ([]) by BAY004-OMC3S17.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008);

You can't remove that info, because it's added by the receiving SMTP server (3rd party). But maybe you can find a relay service that will keep you private. I use an outbound mail relay service that includes nothing about my server in it's headers. Inbound mail will not be an issue for you unless you bounce something back.

You'll also need to follow EEAA's directions to remove headers that your mail server has added before it goes out to the relay. Because it will also add things like Received: From example.com or x.x.x.x and the likes... though the hostname need not be a valid FQDN - in my case messages go out with an internal (not valid) domain name that can't be traced back to me in the headers and no IP addresses.

3rd party SMTP relays are nice in my opinion. They take some of the work out of dealing with the complexities of email. They often provide some lovely services to make your life easier.

FYI, I'm not hiding anything, it's just the way I'm setup!

  • Excellent warning on bounces! A catch-all user should keep me clear of that. – Moonstone Aug 18 '16 at 4:16

Set up another MTA and then configure your real mailserver to relay through it. Assuming you're using postfix, you can use postfix cleanup directives to clean up undesired headers.

If you're not able to achieve your goal with built-in postfix functionality, you can add Mailscanner into the mix, which can be used to perform more aggressive edits to mails as they travel through the server.

As with all mail relays, please ensure that it's not configured as an open relay - limit connections using authentication, firewall rules, or preferably both.

  • Thank you. Do you know any way to do this using just network forwarding rules or possibly even assigning apache to listen on port 25 and have it proxy traffic itself? – Moonstone Aug 18 '16 at 2:48
  • Oh dear. Please take a moment and educate yourself on the technologies you're dealing with. Email uses SMTP. Apache uses HTTP. Apache knows absolutely nothing about SMTP. If you want to work with email messages, you'll need a technology that speaks SMTP. – EEAA Aug 18 '16 at 2:49
  • No need to freak out. =) I am aware of that. However if apache can simply ignore the traffic type and forward the request, in theory it would work for receiving mail. – Moonstone Aug 18 '16 at 2:51
  • Again, Apache only understands HTTP. There are much more to these protocols than just what port they listen on. So, you can try to get Apache to do this, but you will not have any luck. – EEAA Aug 18 '16 at 2:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.