Postfix smtp client HELO on dualstack ipv4/ipv6

Question

I have a Postfix mail server configured for outbound email, on a dual stack (IPv4 + IPv6) server.

The IPv4 address is private as it's shared with other services on the same connection (SNATed to public IPv4) and the IPv6 address is public and unique (global scope, internet routable).

In this situation, it is common to have the public IPv4 and IPv6 addresses to have different reverse DNS (PTR record), so I'd like Postfix to use the HELO in its SMTP client to match the reverse DNS. It is good practice to have this matching, because aggressive mail filtering triggers on having this set up asymmetrical.

My situation:

• IPv4 10.0.3.12 - SNATed to 212.XX.XX.22 (PTR - srv1.example.com, A of srv1.example.com points to 212.XX.XX.22)

• IPv6 of the host (not used here), 2001:XX:XX::1 (PTR - srv1.example.com, AAAA of srv1.example.com points to 2001:XX:XX::1)

• IPv6 of the Postfix container, 2001:XX:XX::12 (PTR - srv1-postfix.example.com, AAAA of srv1-postfix.example.com points to 2001:XX:XX::12)

The HELO hostname used must depend on the address family the SMTP client uses to set up the connection. If it is sending via IPv4, the HELO must be srv1.example.com, and if the client is sending via IPv6 the HELO must be srv1-postfix.example.com in order to be compliant with SMTP best practices.

How it can be done? I'd like to avoid any form of NATing on IPv6.

---

I've seen this: postfix multiple IP SMTP banner. It is not very helpful here, because it explains how to set up domain-specific banner on the listening sockets (smtpd) rather than the SMTP client (smtp).

Answer 1

Your problem is essentially that for mail it is important that forward and reverse lookups of hostname and IP-address align. (Please note that for most other services that is much less important.)

Currently the hostname your mail server will appear with on IPv4 is different from the one it is seen using on IPv6.

The easiest solution is to simply align your server names so that mail server will be known by the same hostname on both IPv4 and IPv6.

In other words: give the host a new name, and change the hostname your Postfix is using from srv1-postfix to srv1 and update the IPv6 records accordingly.

Then you get the usual situation where your Postfix host has a single hostname srv1.example.com, one IPv4 address (192.0.2.1) and one IPv6 2001:db8:0:0:0:0:0:1 address and all forward and reverse mappings resolve to a the same srv1.example.com

The necessary DNS records for receiving and sending mail would then be

example.com.        IN MX 1 srv1.example.com.
srv1.example.com.   IN A    192.0.2.1
srv1.example.com.   IN AAAA 2001:db8:0:0:0:0:0:1

and the corresponding reverse records are

1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. IN PTR srv1.example.com. 
1.2.0.192.in-addr.arpa. IN PTR srv1.example.com. 

Then in your postfix you could simply use myhostname = srv1.example.com and everywhere where a hostname is needed (such as in a EHLO banner) that hostname will be used and align correctly.