Hi there,

I have a problem that I can’t solve on my own and really need help with :/ I hope this thread will also help others. I have already looked closely at various configuration options, but keep encountering new/different problems.

The situation

I have a mailcow docker setup.. so nice, so far =)
I host multiple domains with mailboxes running on this setup, e.g.
- user@abc.net
- sender@news.example.org
An external domain (e.g. example.org) exists, which is not pointing to my mailcow setup (mx-record ≠ mailcow IP )

The goal

I want to configure my setup that way, that sender@news.example.org can send with from=news@example.org to the world.
(assume that spf, dkim etc. are correct configured at example.org)

What is the best approach for such a situation? It doesn’t seem to be all that unusual.

Attempts

Alias domain and alias

My first trivial attempt was to configure example.org as an alias domain for news.example.org and create an alias news@example.org for sender@news.example.org.

That works, but then user@abc.net wasn’t able to send to admin@example.org anymore, because my mailcow instance wanted to be responsible for example.org (for outgoing mails) then.
(I validated this behavior by following the postfix-configuration with the mysql-database entries.)

External domain as relay domain

After my first try, I thought it would be the correct idea, to setup example.org as an relay-domain.

Means I deleted the alias domain including the configured aliase and created a “normal” domain configured with the relaying options. Further I set the domain ACL for sender@news.example.org that way, that sender@news.example.org could send from any mail address (*@example.org) for the example.org relay-domain.

That way,

user@abc.net was able to send to admin@example.org and
sender@news.example.org could send as news@example.org (or even as postmaster@example.org).

Accepting, that sender@news.example.org will be nice and does not hijack some xyz@example.org mails I thought this solutions works, but it didn’t.

Drawbacks

Now where example.org was configured as relay-domain, my mailcow instance cloud be used as a spam proxy for example.org because it will forward (relay) messages for this domain…
Further an user like admin@example.org was not be able to send to user@abc.net anymore, because mailcow wanted validate the sender address admin@example.org and was not able to find a mailbox.

Analyzing the behavior

Configuring a relay domain will result as an entry in

smtpd_sender_login_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_sender_acl.cf

Due to the column header, the relay feature seams to be thought as backup_mx. Not exactly what I had in mind.

Add custom whitelist to `smtpd_sender_login_maps`

My last try was to modify smtpd_sender_login_maps manually. Therefore I removed the configured relay-domain, that mailcow does not know about this domain anymore.

Afterwards I add a line to my extra.cf:

+smtpd_sender_login_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_sender_acl.cf,
+  hash:/opt/postfix/conf/virtual_sender_acl_extra_allowed_aliases.cf

with virtual_sender_acl_extra_allowed_aliases.cf like

@example.org         sender@news.example.org

and run postmap manually and restarted the postfix-mailcow container.

I thought I got it, but now “mailcow” was not able to configure the DKIM-settings for example.org anymore, because “mailcow” does not know about example.org anymore.

That’s where I stuck 🙁