Unable to disable local inbox #3472

Daerendor · 2023-08-10T01:28:42Z

Daerendor
Aug 10, 2023

Let me describe my env first.
I have specific MX records on domain.tld that will redirect the emails for domain.tld to a third party service.
For [email protected] --> third party inbox
I also have some selfhosted apps, and I'd like to send emails from them.
From [email protected] to anyone

Some of these emails (especially system-related ones) are sent for me as well. This means that they end up in my DMS inbox (since they are treated as local by DMS). However, I would like to let them be sent just as any other email, since my MX records will make them go to my thid-party inbox.
From [email protected] To [email protected] --> MX --> third party inbox

To achieve this goal, I tried setting $mydestination to localhost, I also tried to leave it empty, but it did not work.
Tl;dr, I am trying to "disable" local inbox.
Any clues?

Note: I am using local auth.

Answered by Daerendor

Aug 13, 2023

I managed to get it working, thanks to this issue you told me to take a look at.

mail.env

SMTP_ONLY=1
SMTP_USERNAME=user
SMTP_DOMAIN=domain.tld
SMTP_PASSWORD=password
ENABLE_SASLAUTHD=1
SASLAUTHD_MECHANISMS=

postfix-main.cf

smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
smtpd_sasl_type = cyrus

user-patches.sh

#!/bin/bash

mkdir -p /etc/postfix/sasl

echo "pwcheck_method: auxprop
auxprop_plugin: sasldb
mech_list: PLAIN" > /etc/postfix/sasl/smtpd.conf

echo $SMTP_PASSWORD | saslpasswd2 -c -u $SMTP_DOMAIN $SMTP_USERNAME

I believe $SMTP_DOMAIN is useless, but I am not a pro at this so I'll leave it like this for now.

Adding a new 'local' mechanism to SASLAUTD_MECHANISMS, doing exactly t…

View full answer

polarathene · 2023-08-10T22:38:46Z

polarathene
Aug 10, 2023
Maintainer

mydestination is for Postfix to store in /var/mail instead of sending to Dovecot over LMTP to store in a subdir of /var/mail which Dovecot manages. The mydestination domain is used for system accounts (amavis/clamav/root/etc) and Postfix itself to manage internal mail specific to DMS, not accounts you add to DMS.

A common scenario is [email protected] (DMS hostname, no setup email add used), while the same example.com is used explicitly for user mail accounts like [email protected].

Some users misunderstand this and think configuring a bare domain with the config hostname: example.com is a better choice as they believed they were setting up [email protected], but DMS hostname and email accounts you setup with setup email add are unrelated, you cannot overlap them though... so our FAQ entry on bare domains advises modifying mydestination, which can cause delivery issues with those internal system/postfix accounts.

As for local inbox, it's not clear what you're referring to here. If email is submitted to DMS (Postfix) to send mail it should be via ports 587 or 465, both requiring auth to send mail outbound (to a third-party mail server).

You have your sender ([email protected]) and your recipient ([email protected]). In this case [email protected] may be recognized as a local account managed by Dovecot and mail gets delivered there. If you have created an explicit [email protected] account that will be the case, otherwise if you have a wildcard virtual alias @example.com to redirect to a third-party mail service, then mail should be sent to that, unless a [email protected] virtual alias was defined earlier and directed it somewhere else. Virtual aliases (setup alias add) have priority over local Dovecot accounts (setup email add).

If what you need is a local [email protected] to store your mail in Dovecot sometimes, but send to a third-party when the sender address is something specific ([email protected]) you could configure Postfix for this but DMS has no official support for such.
If you have no need for any local storage of mail and always use a third-party service, then setup alias add is what you want, not setup email add, and a wildcard to modify the recipient domain / address should do the trick (@example.com to [email protected]).

So it sounds like your main issue is you created a @example.com local account with setup email add where that example.com domain is not actually managed by DMS, that is a misconfiguration as you're telling DMS that it manages mail for that domain (should have an MX record pointing to DMS).

If spoof protection is not enabled in DMS ENV, then you can have any setup email add account you make (doesn't have to be for example.com) can send mail as any address (once authenticated over port 465 or 587).

setup email add [email protected]
Login as [email protected] to DMS at mail.example.com
Send mail as [email protected], or even as [email protected] (which will fail if gmail.com DNS doesn't allow mail.example.com to send)
Mail is submitted to DMS account [email protected], and then mail.example.com connects to the recipient address ([email protected]) mail server (MX record) with the mail sender you chose ([email protected]).

That said, there may be a Postfix setting that would force the MX record lookup, even when there is a local mailbox domain match like example.com that Postfix thought it was the final delivery location too. I believe you're trying to configure DMS as a "null mailer" (sender-only service).

5 replies

Daerendor Aug 12, 2023
Author

Thank you very much for your reply, lot of useful information here.

Starting from the bottom,

Yes, since I already have MX records for example.com pointing to my third party mailing service, checking the "external" MX even for local accounts is something I'm looking for. And yeah, I'm using DMS as a send-only service, for other docker apps.
My third party service has a catch-all thing configured, so I really don't need any local inbox.
Yeah, I've read the docs and other GH issues, the ones that end by someone saying "Add user-patches to change mydestination, but you shouldn't do it". I guess I'm going to try and avoid it.

I tried setting up the recommended way, i.e. not a bare domain.
Something is still unclear to me tho, about the local inbox delivery .

echo "smth" | mail -s "sub" [email protected] -r [email protected]

Aug 12 01:47:39 mail postfix/pickup[637]: C14D26395E: uid=0 from=<[email protected]>
Aug 12 01:47:39 mail postfix/cleanup[650]: C14D26395E: message-id=<[email protected]>
Aug 12 01:47:39 mail opendkim[524]: C14D26395E: DKIM-Signature field added (s=mail, d=domain.tld)
Aug 12 01:47:39 mail postfix/qmgr[638]: C14D26395E: from=<[email protected]>, size=450, nrcpt=1 (queue active)
Aug 12 01:47:39 mail dovecot: lmtp(644): Connect from local
Aug 12 01:47:39 mail dovecot: auth: passwd-file([email protected]): unknown user
Aug 12 01:47:39 mail postfix/lmtp[640]: C14D26395E: to=<[email protected]>, relay=mail.domain.tld[/var/run/dovecot/lmtp], delay=0.1, delays=0.09/0/0/0, dsn=5.1.1, status=bounced (host mail.domain.tld[/var/run/dovecot/lmtp] said: 550 5.1.1 <[email protected]> User doesn't exist: [email protected] (in reply to RCPT TO command))
Aug 12 01:47:39 mail dovecot: lmtp(644): Disconnect from local: Logged out (state=READY)
Aug 12 01:47:39 mail postfix/cleanup[648]: D4D5563960: message-id=<[email protected]>
Aug 12 01:47:39 mail postfix/bounce[645]: C14D26395E: sender non-delivery notification: D4D5563960
Aug 12 01:47:39 mail postfix/qmgr[638]: D4D5563960: from=<>, size=3201, nrcpt=1 (queue active)
Aug 12 01:47:39 mail postfix/qmgr[638]: C14D26395E: removed
Aug 12 01:47:39 mail dovecot: lmtp(642): Connect from local
Aug 12 01:47:39 mail dovecot: lmtp([email protected])<642><OEJqNJvI1mSCAgAAvaCfBw>: sieve: msgid=<[email protected]>: stored mail into mailbox 'INBOX'
Aug 12 01:47:39 mail postfix/lmtp[641]: D4D5563960: to=<[email protected]>, relay=mail.domain.tld[/var/run/dovecot/lmtp], delay=0.02, delays=0.01/0/0/0.01, dsn=2.0.0, status=sent (250 2.0.0 <[email protected]> OEJqNJvI1mSCAgAAvaCfBw Saved)
Aug 12 01:47:39 mail postfix/qmgr[638]: D4D5563960: removed
Aug 12 01:47:39 mail dovecot: lmtp(642): Disconnect from local: Logged out (state=READY)

OVERRIDE_HOSTNAME=
LOG_LEVEL=debug
SUPERVISOR_LOGLEVEL=debug
ONE_DIR=1
ACCOUNT_PROVISIONER=FILE
TLS_LEVEL=modern
SPOOF_PROTECTION=0
ENABLE_SRS=0
ENABLE_OPENDKIM=1
ENABLE_OPENDMARC=1
ENABLE_POLICYD_SPF=1
ENABLE_[OTHER SERVICES]=0
SMTP_ONLY=0
ENABLE_SASLAUTHD=1
SASLAUTHD_MECHANISMS=shadow
SRS_SENDER_CLASSES=envelope_sender

So, based on your recommendations, I configured DMS to use mail.domain.tld, and then I added a @domain.tld user.
Since @domain.tld is not local to mail.domain.tld, it shouldn't be flagged as local delivery, right? So why is this happening? Is this related to the "force MX check" you were talking about?

polarathene Aug 13, 2023
Maintainer

Breaking down the log

Since @domain.tld is not local to mail.domain.tld, it shouldn't be flagged as local delivery, right?

Aug 12 01:47:39 mail postfix/pickup[637]: C14D26395E: uid=0 from=<[email protected]>
Aug 12 01:47:39 mail postfix/cleanup[650]: C14D26395E: message-id=<[email protected]>
Aug 12 01:47:39 mail opendkim[524]: C14D26395E: DKIM-Signature field added (s=mail, d=domain.tld)
Aug 12 01:47:39 mail postfix/qmgr[638]: C14D26395E: from=<[email protected]>, size=450, nrcpt=1 (queue active)

The mail has arrived to DMS (Postfix) from the sender [email protected].
It is assigned a message-id and signed with DKIM key.
Message (email) is added to the queue to be handled.

I don't think it should be signed by DKIM unless it's aware it's sending/relaying the mail, not just receiving it 🤔

Aug 12 01:47:39 mail dovecot: lmtp(644): Connect from local
Aug 12 01:47:39 mail dovecot: auth: passwd-file([email protected]): unknown user
Aug 12 01:47:39 mail postfix/lmtp[640]: C14D26395E: to=<[email protected]>, relay=mail.domain.tld[/var/run/dovecot/lmtp], delay=0.1, delays=0.09/0/0/0, dsn=5.1.1, status=bounced (host mail.domain.tld[/var/run/dovecot/lmtp] said: 550 5.1.1 <[email protected]> User doesn't exist: [email protected] (in reply to RCPT TO command))

Now Postfix has connected to the virtual transport over LMTP, which is to Dovecot for local delivery. At least when it's for the domain it believes it owns fully for delivery (@domain.tld).
I think at this stage Postfix is checking with Dovecot if an actual mail account sends before continuing. In this case it gets told this user is not known, there is no inbox to delivery to.
Since Postfix thinks that Dovecot is the final destination, it decides something is not right and chooses to send a bounce email back to the sender [email protected].

Aug 12 01:47:39 mail dovecot: lmtp(642): Connect from local
Aug 12 01:47:39 mail dovecot: lmtp([email protected])<642><OEJqNJvI1mSCAgAAvaCfBw>: sieve: msgid=<[email protected]>: stored mail into mailbox 'INBOX'
Aug 12 01:47:39 mail postfix/lmtp[641]: D4D5563960: to=<[email protected]>, relay=mail.domain.tld[/var/run/dovecot/lmtp], delay=0.02, delays=0.01/0/0/0.01, dsn=2.0.0, status=sent (250 2.0.0 <[email protected]> OEJqNJvI1mSCAgAAvaCfBw Saved)

Now the same process happens, but in this case you have created a [email protected] account (setup email add?), so it is accepted and delivered to local storage managed by Dovecot, not your third-party service you would have wanted.

Avoiding local delivery (send-only)

Is this related to the "force MX check" you were talking about?

Actually, since you don't need Dovecot for any local storage right? You can just disable Dovecot, it is not doing anything for you from what I understand?

The earlier mentioned system accounts that mail to @mail.domain.tld by default will still be handled by Postfix storing in /var/mail, unless you setup proper alias config to route to your @domain.tld address, which should then get delivered to the third-party mail service after solving the below concern.

`SMTP_ONLY=1` (when you don't need Dovecot / mail storage)

We have SMTP_ONLY=1 for this, it was implemented before I became a maintainer of the project.

That configures Postfix to disable SASL auth unless you're using ENABLE_SASLAUTHD=1:

docker-mailserver/target/scripts/startup/setup.d/postfix.sh

Lines 25 to 40 in f28fce9

    
             __postfix__log 'trace' "Configuring SASLauthd" 
        
             if [[ ${ENABLE_SASLAUTHD} -eq 1 ]] && [[ ! -f /etc/postfix/sasl/smtpd.conf ]]; then 
        
               cat >/etc/postfix/sasl/smtpd.conf << EOF 
        
           pwcheck_method: saslauthd 
        
           mech_list: plain login 
        
           EOF 
        
             fi 
        
             if [[ ${ENABLE_SASLAUTHD} -eq 0 ]] && [[ ${SMTP_ONLY} -eq 1 ]]; then 
        
               sed -i -E \ 
        
                 's|^smtpd_sasl_auth_enable =.*|smtpd_sasl_auth_enable = no|g' \ 
        
                 /etc/postfix/main.cf 
        
               sed -i -E \ 
        
                 's|^  -o smtpd_sasl_auth_enable=.*|  -o smtpd_sasl_auth_enable=no|g' \ 
        
                 /etc/postfix/master.cf 
        
             fi

And disables setting up Dovecot and the local user database (ACCOUNT_PROVISIONER=FILE):

docker-mailserver/target/scripts/start-mailserver.sh

Lines 45 to 56 in f28fce9

    
           if [[ ${SMTP_ONLY} -ne 1 ]]; then 
        
             _register_setup_function '_setup_dovecot' 
        
             _register_setup_function '_setup_dovecot_sieve' 
        
             _register_setup_function '_setup_dovecot_dhparam' 
        
             _register_setup_function '_setup_dovecot_quota' 
        
             _register_setup_function '_setup_spam_to_junk' 
        
           fi 
        
           case "${ACCOUNT_PROVISIONER}" in 
        
             ( 'FILE'  ) 
        
               _register_setup_function '_setup_dovecot_local_user' 
        
               ;;

docker-mailserver/target/scripts/startup/setup.d/dovecot.sh

Lines 136 to 138 in f28fce9

    
           function _setup_dovecot_local_user() { 
        
             [[ ${SMTP_ONLY} -eq 1 ]] && return 0 
        
             [[ ${ACCOUNT_PROVISIONER} == 'FILE' ]] || return 0

docker-mailserver/target/scripts/check-for-changes.sh

Lines 104 to 105 in f28fce9

    
           _log_with_date 'trace' 'Regenerating accounts (Dovecot + Postfix)' 
        
           [[ ${SMTP_ONLY} -ne 1 ]] && _create_accounts

docker-mailserver/target/scripts/helpers/accounts.sh

Lines 9 to 18 in f28fce9

    
           DOVECOT_USERDB_FILE=/etc/dovecot/userdb 
        
           DOVECOT_MASTERDB_FILE=/etc/dovecot/masterdb 
        
           function _create_accounts() { 
        
             : >/etc/postfix/vmailbox 
        
             : >"${DOVECOT_USERDB_FILE}" 
        
             [[ ${ACCOUNT_PROVISIONER} == 'FILE' ]] || return 0 
        
             local DATABASE_ACCOUNTS='/tmp/docker-mailserver/postfix-accounts.cf'

docker-mailserver/target/scripts/check-for-changes.sh

Line 57 in f28fce9

[[ ${SMTP_ONLY} -ne 1 ]] && dovecot reload

Authenticating with `SMTP_ONLY=1` (Probably with `ENABLE_SASLAUTHD=1`)

Easiest may be with LDAP, but there are a few other options.

However, the contributor that introduced this feature I believe introduced the SASL provider alternative (instead of from Dovecot), SASLAuthD. So there is extra setup required, but the original Wiki never had this information contributed (our current docs didn't exist at the time, so wasn't part of the PR process).

We have a FAQ entry for SMTP_ONLY=1 that references an issue discussing some approaches to add users to authenticate with for mail submission. For context, in 2019 Cyrus (EDIT: might have been Courier) was used instead of Dovecot IIRC, and while the user starts with ENABLE_SASLAUTHD=1, it looks like they use a different config approach? (EDIT: maybe not, seems the Postfix docs for Cyrus SASL is related to saslauthd) And earlier this year another user shared their user-patches.sh snippet (looks like it has a typo, probably should be pwcheck_method, not wcheck_method).

There's also a brief mention in a user contributed guide for a relay server setup using SMTP_ONLY=1, this highlights a few other services that aren't relevant for a server just passing on mail (and presumably applicable when only sending too), so could be disabled. SMTP_ONLY=1 could probably be updated to also disable those services 🤷‍♂️

Our test coverage for the SMTP_ONLY=1 feature doesn't look too great though. For the ENABLE_SASLAUTHD=1 feature, the contributor only introduced it for connecting to their LDAP provider, and for some reason they also have a rimap provider test (not sure what that is, but since SMTP_ONLY=1 is not used, it may be an alternative to use Dovecot SASL), here's the related config file if you choose to look into ENABLE_SASLAUTHD=1:

docker-mailserver/target/supervisor/conf.d/saslauth.conf

Lines 28 to 35 in f28fce9

    
           [program:saslauthd_rimap] 
        
           startsecs=0 
        
           autostart=false 
        
           autorestart=true 
        
           stdout_logfile=/var/log/supervisor/%(program_name)s.log 
        
           stderr_logfile=/var/log/supervisor/%(program_name)s.log 
        
           command=/usr/sbin/saslauthd -d -a rimap -r -O "%(ENV_SASLAUTHD_MECH_OPTIONS)s" 
        
           pidfile=/var/run/saslauthd/saslauthd.pid

EDIT: Yeah, according to the note in this LDAP user contributed guide, the rimap saslauthd provider seems to use Dovecot. It seems to be a generic IMAP provider solution instead of the Postfix support for Dovecot directly as a SASL provider.

These are features that no active maintainer is that familiar with, nor has too much time to delve into unfortunately. So their maintenance is a bit lackluster.

Alternative: Disabling the Postfix config related to Dovecot delivery, but keeping the Dovecot SASL auth integration enabled

Without SMTP_ONLY=1, it might be possible to override Postfix config with postfix-main.cf and postfix-master.cf, to still leverage the account management with Dovecot, but opt-out of Postfix using it for delivery, only authentication to send mail.

Off the top of my head I don't know the exact settings, I think it's mostly the virtual_ prefix for delivery to Dovecot. Our scripts also probably parse the accounts and aliases config to extract domains which may be relevant. So we could improve on this, but presently it may not be any easier than the other alternative auth solutions.

polarathene Aug 13, 2023
Maintainer

TL;DR: You probably want SMTP_ONLY=1, it'll opt-out of support to receive mail.

This may break authentication support needed to send mail outbound (to your service). Looks like that can be resolved by enabling LDAP (problematic for some users, no real maintainer support in DMS), or ENABLE_SASLAUTHD=1 with some extra config that DMS has no official docs / support for at present.

Raised a TODO task issue, hopefully someone may find time to contribute improvements to supporting this usage better with DMS: #3477

Daerendor Aug 13, 2023
Author

I managed to get it working, thanks to this issue you told me to take a look at.

mail.env

SMTP_ONLY=1
SMTP_USERNAME=user
SMTP_DOMAIN=domain.tld
SMTP_PASSWORD=password
ENABLE_SASLAUTHD=1
SASLAUTHD_MECHANISMS=

postfix-main.cf

smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
smtpd_sasl_type = cyrus

user-patches.sh

#!/bin/bash

mkdir -p /etc/postfix/sasl

echo "pwcheck_method: auxprop
auxprop_plugin: sasldb
mech_list: PLAIN" > /etc/postfix/sasl/smtpd.conf

echo $SMTP_PASSWORD | saslpasswd2 -c -u $SMTP_DOMAIN $SMTP_USERNAME

I believe $SMTP_DOMAIN is useless, but I am not a pro at this so I'll leave it like this for now.

Adding a new 'local' mechanism to SASLAUTD_MECHANISMS, doing exactly this could be an idea. I'll leave it to you to update the todo you've created.

Thanks!

Answer selected by Daerendor

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Docker Mailserver

Unable to disable local inbox #3472

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Docker Mailserver

Unable to disable local inbox #3472

Uh oh!

Daerendor Aug 10, 2023

Replies: 1 comment · 5 replies

Uh oh!

polarathene Aug 10, 2023 Maintainer

Uh oh!

Daerendor Aug 12, 2023 Author

Uh oh!

polarathene Aug 13, 2023 Maintainer

Breaking down the log

Avoiding local delivery (send-only)

SMTP_ONLY=1 (when you don't need Dovecot / mail storage)

Authenticating with SMTP_ONLY=1 (Probably with ENABLE_SASLAUTHD=1)

Alternative: Disabling the Postfix config related to Dovecot delivery, but keeping the Dovecot SASL auth integration enabled

Uh oh!

Uh oh!

polarathene Aug 13, 2023 Maintainer

Uh oh!

Daerendor Aug 13, 2023 Author

Daerendor
Aug 10, 2023

Replies: 1 comment 5 replies

polarathene
Aug 10, 2023
Maintainer

Daerendor Aug 12, 2023
Author

polarathene Aug 13, 2023
Maintainer

`SMTP_ONLY=1` (when you don't need Dovecot / mail storage)

Authenticating with `SMTP_ONLY=1` (Probably with `ENABLE_SASLAUTHD=1`)

polarathene Aug 13, 2023
Maintainer

Daerendor Aug 13, 2023
Author