Postfix – Stopping Outgoing Delivery While Accepting Incoming

mac-osxpostfixsmtp

I'm doing development for a webapp that sends emails out to users. I've typically used Argosoft Mail Server (Freeware) in a windows environment as an SMTP server in which I've enabled relay but shutdown actual delivery. This allow me to point my webapp to my local server, and am able to validate all emails that are sent out by looking at the outgoing queue. Additionally, to be 100% safe, I would put in a non-existant DNS server to use to ensure that if I ever accidentally enable delivery, the server would still not be able to look up any external addresses and deliver the mail.

Now that I am doing development on an OSX machine, I'm looking for a similar solution. By default, OSX comes with Postfix installed, so I figured I would just use that and configure it similarly. However, I cannot seem to find an option anywhere to disable all outgoing email. Essentially, I want to set up Postfix as an open relay server, but disable delivery of all email. I can then look at the outgoing queue and see if the email(s) are as expected.

Is there anyway to easily accomplish this? Or is there a better solution I can use?

Best Answer

Put All Out Going Email On Hold

In main.cf, put following check_recipient_access as first option of smtp_sender_restrictions 2

smtpd_sender_restrictions =
    check_recipient_access regexp:/etc/postfix/onhold
    ...
    ...

Create /etc/postfix/onhold with following content
```
/example\.com$/ DUNNO
/^/ HOLD
```

Everything will be put into hold queue, except email for example.com.

Base on postfix site, change

queue_run_delay = 3600

300 is default, which is 5min. Change it to 3600 will make it retry once per hour. You can try change it to 86400(24hr). I think that should give you enough time for testing and inspecting email contect.

Related Solutions

Ubuntu Postfix Configuration – Forward All Incoming Email to Single Address

This is called a "catch all"

Mapping is done using /etc/postfix/virtual file.

vi /etc/postfix/virtual

Append code as follows, replacing domain and emailusername with actual values:

@yourdomain.com emailusername

Save and close the file. Run following command:

postmap /etc/postfix/virtual

Also make sure you have following line in /etc/postfix/main.cf file:

virtual_alias_maps = hash:/etc/postfix/virtual

If you just added above, line reload postfix:

service postfix reload

From http://www.cyberciti.biz/faq/howto-setup-postfix-catch-all-email-accounts/

Postfix – DKIM Sign Outgoing Mail from Any Domain

Ok I managed to figure this out on my own, but I wanted to post the steps here for posterity because there was zero documentation on this (that I could find) and it was practically guess and check.

After I set "Domain *" as described above, it would sign it like this:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=clientdomain.com;
    s=main; t=1250005729;
    bh=twleuNpYDuUTZQ/ur9Y2wxCprI0RpF4+LlFYMG81xwE=;
    h=Date:From:To:Message-Id:Subject:Mime-Version:Content-Type;
    b=kohI7XnLlw/uG4XMJoloc4m9zC13g48+Av5w5z7CVE0u3NxsfEqwfDriapn7s7Upi
     31F3k8PDT+eF57gOu2riXaOi53bH3Fn/+j0xCgJf8QpRVfk397w4nUWP/y8tz4jfRx
     GhH21iYo05umP0XflHNglpyEX02bssscu2VzXwMc=

notice the "d=clientdomain.com". It was generating this based on the from address in the email, where the from address was something like "contact@clientdomain.com". Obviously if it checked the client's domain and not mine no DNS TXT record was there and the verification would fail.

So anyway I found out in this documentaion that you can set a KeyList parameter. http://manpages.ubuntu.com/manpages/hardy/man5/dkim-filter.conf.5.html

It didn't really describe what I wanted to do, but I figured I'd play with it. I commented out KeyFile and set KeyList to "/etc/mail/dkim_domains.key" which is an arbitrary file name I made up. I then created that file and put this in it "*:feedmailpro.com:/etc/mail/dkim.key". This tells it for any client domain, sign it with my domain (feedmailpro.com), and use the dkim.key file.

Restarted DKIM and postfix

sudo /etc/init.d/dkim-filter restart
sudo /etc/init.d/postfix restart

Now this is the key it generated when I sent a test email.

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=feedmailpro.com;
    s=dkim.key; t=1250005729;
    bh=twleuNpYDuUTZQ/ur9Y2wxCprI0RpF4+LlFYMG81xwE=;
    h=Date:From:To:Message-Id:Subject:Mime-Version:Content-Type;
    b=kohI7XnLlw/uG4XMJoloc4m9zC13g48+Av5w5z7CVE0u3NxsfEqwfDriapn7s7Upi
     31F3k8PDT+eF57gOu2riXaOi53bH3Fn/+j0xCgJf8QpRVfk397w4nUWP/y8tz4jfRx
     GhH21iYo05umP0XflHNglpyEX02bssscu2VzXwMc=

Improvement, you see the d= now is set to my domain (even though the from address of the email was not my domain). However s= got changed to "dkim.key" instead of the selector I chose in dkim-filter.conf. In the original setup instructions I'd set the selector to "mail". That was weird, but I noticed it changed it to the filename of my key, dkim.key.

So I went and renamed "/etc/mail/dkim.key" to "/etc/mail/mail". Also updated the reference to it in "/etc/mail/dkim_domains.key".

Restart dkim-filter and postfix again same as above, and now it started working. Here is the final header which signs correctly using the right selector (apparently based off the filename of the key).

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=feedmailpro.com;
    s=mail; t=1250006218;
    bh=tBguOuDhBDlhv0m4KF66LG10V/8ijLcAKZ4JbjpLXFM=;
    h=Date:From:To:Message-Id:Subject:Mime-Version:Content-Type;
    b=c9eqvd+CY86BJDUItWVVRvI3nibfEDORZbye+sD1PVltrcSBOiLZAxF3Y/4mP6vRX
     MUUNCC004oIH1u7FYafgF32lpuioMP1cd7bi6x3AZ5zH4BYETNBnnz4AhAPBtqlIh/
     FFMz8jkhhLhcM2hDpwJkuKjAe3LzfNVDP8kD11ZI=

Now s=mail is right, and d=feedmailpro.com is right. It works!

Overall this was way harder than I expected and there seemed to be zero documentation on how to do this (signing for all outgoing domains), but I guess it's open source software so I can't complain.

One final note, to check if the TXT DNS record was setup correctly you can do a command like with your domain

dig mail._domainkey.feedmailpro.com TXT

May need to install dig (sudo apt-get install dig). If you're using Slicehost manager to add the DNS entry, you'd enter the TXT record like this.

Type: TXT
Name: mail._domainkey
Data: k=rsa; t=s; p=M5GfMA0...YOUR LONG KEY...fIDAQAB
TTL seconds: 86400

I don't really understand why the name is set to "mail._domainkey" without a period on the end or without my domain, like "mail._domainkey.feedmailpro.com". But whatever, it seems to work so I'm happy.

If you're trying to duplicate this, here are the instructions I started with: https://help.ubuntu.com/community/Postfix/DKIM

Best Answer

Put All Out Going Email On Hold

Related Solutions

Ubuntu Postfix Configuration – Forward All Incoming Email to Single Address

Postfix – DKIM Sign Outgoing Mail from Any Domain

Related Topic