Removing headers from postfix-sent mail

It seems serverfault has already got a meaningful answer on that:
using header_checks directive in main.cf.

See the full answer.

I suggest you also read the comments, that do not recommend to remove systematically the headers.

You can use header_checks to either IGNORE the header, or, better, to REPLACE it using a regexp to X-Received or something similar.

That being said, if you remove your Received: line, keep in mind that it may increase the spam probability on emails sent by that server. Headers checking is frequently one part of the Bayesian spam analysis.

You can set up a post queue filter. How are your perl/sed skills?

The first thing you need to do is write a script that will accept a raw message on STDIN, and modify the message as you'd like (I'll assume that you have this capability already). You then configure postfix to pass all messages to that script as a filter. As the last thing the script does, pass the message back to postfix.

For writing the script, I suggest using perl. It has a very powerful regexp engine. You can also use Net::SMTP to make resubmission back to postfix easy.

Here's how to configure postfix to do this:

In master.cf on your smtpd line, change the last part to include the filter.

Original line:

smtp      inet  n       -       n       -       -       smtpd

New line:

smtp      inet  n       -       n       -       -       smtpd -o content_filter=myfilter

Add your filter service to master.cf:

myfilter unix  -       n       n       -       3       pipe
    flags=   user=nobody argv=/usr/local/bin/myfilter.pl localhost 25252 $sender $recipient

Note that the sender and recipient here are from the envelope not the body. You'll need this to be part of the envelope when passing the message back to postfix.

Finally add an unfiltered smtp receiver to master.cf to accept the newly modified messages:

local:25252 inet n      -       n       -       -       smtpd
    -o content_filter=

Sure, you can mangle existing headers in postfix if you really want. But IIRC, most MTAs won't add that header unless it hasn't already been added by the MUA.

As has been mentioned, Postfix header_checks is the place to do this. I use this on mail relays that send mail on behalf of servers in Amazon's EC2 cloud. Anti-spam systems hate finding anything related to EC2, so this kind of cloaking is regrettably necessary. That said, I would probably replicate this configuration for production networks in the future. Mail reputation is a tricky business, and cloaking all mail so that it appears to originate from a small number of relays makes that reputation management easier.

Here is an example header_checks snippit for your consideration.

/^(Received: .amazonaws.com.)/ REPLACE X-Cloak-$1

This finds and grabs "Received: host1.amazonaws.com" and replaces it with "X-Cloak-Received: host1.amazonaws.com".