I have a question which is not about the configuration but about the question what is right and what not.

The scenario: Organisation A (OrgA) has a Mailserver which is responsible for example.org. The Head of OrgA is also Head of Company B (CompB, example.com). Now the it guys from OrgA used their Postfix aliases file to forward all mails for Head.Boss@example.org to Head.Boss@example.com

Should look like this:

cat /etc/postfix/aliases

Now a worker of CompanyC writes an email to Head.Boss@example.org which gets "redirected" to Head.Boss@example.com. In that case the Mailserver of OrgA acts as simple mail relay, right? If CompanyC provides a SPF record and CompanyB checks this one there should be a failure because the mailserver of OrgA does not match with the SPF of the sender CompanyC.

Is it a good manner to redirect mails to external addresses like that? Or shouldn't that matter because there is no DMARC Record which tells to drop messages not matching the SPF?


The it people at orga.com should use SRS to forward the mail. For instructions on how to set this up, see: https://jichu4n.com/posts/setting-up-dkim-and-srs-in-postfix/ . For more information, see: https://en.wikipedia.org/wiki/Sender_Rewriting_Scheme

| improve this answer | |

Company B (example.com) should be aware that the Organization A (example.org) is forwarding the mail. This way the mailserver of example.com could be trusted to perform the SPF/DMARC checks on behalf of the mailserver of example.org and, thus, the SPF/DMARC checks can be omitted.

While the implementation is a technical solution, this really comes to the trust relationship between the organizations in question, as well as whether potentially confidential information about Organization A should be forwarded to and held on the servers of Company B.

| improve this answer | |
  • But you cannot have this trust relation with every company that is possible to write emails. – Nico Sep 10 '19 at 12:54
  • In the described scenario, you don't have to. Company C has nothing to do with this. – Esa Jokinen Sep 10 '19 at 13:06
  • Ah, you mean a trust between OrgA und Comany B? Well that would help but if thats not the way you should forward mails you should not accept this. – Nico Sep 10 '19 at 13:33
  • Yes. If there's no such relationship between the organizations, just the same individual, the Head.Boss should have two mailboxes. – Esa Jokinen Sep 10 '19 at 13:38
  • Okey, got you... – Nico Sep 10 '19 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.