Home / server / Questions / 558758
Accepted
Craig Watson
Asked: 2013-12-03 13:00:27 +0800 CST

Postfix: Transport Maps via Third-Party Relay Host

  • 772

I have my website and email hosted with a shared host. Unfortunately their servers are using CPanel, so they are limited in their spam protection options.

I also have a VPS that I use for testing and hosting several other bits and pieces (Why don't I use the VPS for websites? I don't want to have to worry about backups!) - I can potentially use this as my MX for my domains, with the shared host as transport maps - I used to run my own dedi and so have Puppet modules ready to go for a mailserver.

The VPS host requires me to use a Postfix mail relay to make sure I'm not spamming from their IP ranges.

Can I use Postfix's transport_maps and relay_host directives together to make my MX forward all mail for my domains to the shared host, but via the VPS host's relay?

A further example of my desired outcome:

  • example.com has an single MX record (for sanity) of vps.example.com
  • vps.example.com receives incoming mail, then consults transport_maps and forwards it to the eventual destination sharedhost.example.com, using the the relay relayvps.example.net as the "next hop"
postfix

2 Answers

  1. Best Answer

    Personally I wouldn't want to do this. But you could use forwarding addresses on your VPS like this:

    [email protected] -> [email protected]
[email protected] -> [email protected]
...

    Then configure your shared host as MX for subdomain.example.org. Then use transport_maps

    transport_maps = hash:/etc/postfix/transport

    in /etc/postfix/transport put

    @subdomain.example.org smtp:[vps.relay.tld]

    use postmap to update the lookup-table in transport.db with postmap /etc/postfix/transport.

    If you need credentials for the relay you can configure them in /etc/postfix/saslpass

    vps.relay.tld username:password

    and use postmap /etc/postfix/saslpass to create/update the lookup-table.

    On the shared host add the subdomains and forward the mail back to the original addresses. I'm not sure though if the forwarding wouldn't break spam-protection on the VPS.

    • 2

  2. Yes, but you need a little bit of scripting on both side.

    Without scripting you can't do this, if it could be done, it were a serious security flaw (f.e. mails could be sent directly to internal servers behind firewalls).

    The simplest scripting solution were if you packaged the mail to send into another mail as attachment, and sent to the target. On the target it were waited by a .procmailrc or same like, which extracted the attachment and putted it into the outgoing mail queue of the target. I did both side in perl.

    • -1