<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<blockquote type="cite"
cite="mid:91cfb927-3e75-4a05-ac96-774392273044@howitts.co.uk">
For the Postfix bit, I already have:
<br>
#=====================================================================
<br>
# Global antivirus/antispam pre-filter (Amavis)
<br>
#=====================================================================
<br>
smtp-amavis unix - - n - 5 smtp
<br>
-o smtp_data_done_timeout=1200
<br>
-o smtp_send_xforward_command=yes
<br>
-o disable_dns_lookups=yes
<br>
-o max_use=20
<br>
# SMTP interface for injecting mail into Amavis
<br>
127.0.0.1:10025 inet n - n - - smtpd
<br>
-o content_filter=smtp-amavis:[127.0.0.1]:10024
<br>
-o smtpd_restriction_classes=
<br>
-o smtpd_client_restrictions=
<br>
-o smtpd_helo_restrictions=
<br>
-o smtpd_sender_restrictions=
<br>
-o smtpd_recipient_restrictions=permit_mynetworks,reject
<br>
-o mynetworks=127.0.0.0/8
<br>
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
<br>
-o strict_rfc821_envelopes=yes
<br>
-o smtpd_error_sleep_time=0
<br>
-o smtpd_soft_error_limit=1001
<br>
-o smtpd_hard_error_limit=1000
<br>
#=====================================================================
<br>
# Mail re-injection (after pre-filtering)
<br>
#=====================================================================
<br>
127.0.0.1:10026 inet n - n - - smtpd
<br>
-o content_filter=
<br>
-o smtpd_restriction_classes=
<br>
-o smtpd_delay_reject=no
<br>
-o smtpd_client_restrictions=permit_mynetworks,reject
<br>
-o smtpd_helo_restrictions=
<br>
-o smtpd_sender_restrictions=
<br>
-o smtpd_recipient_restrictions=permit_mynetworks,reject
<br>
-o smtpd_data_restrictions=reject_unauth_pipelining
<br>
-o smtpd_end_of_data_restrictions=
<br>
-o mynetworks=127.0.0.0/8
<br>
-o smtpd_error_sleep_time=0
<br>
-o smtpd_soft_error_limit=1001
<br>
-o smtpd_hard_error_limit=1000
<br>
-o smtpd_client_connection_count_limit=0
<br>
-o smtpd_client_connection_rate_limit=0
<br>
<br>
</blockquote>
<p>So you removed the submission service?</p>
<p>A "usual" mail flow is "<a class="moz-txt-link-abbreviated" href="mailto:sender@external.domain">sender@external.domain</a> -> smtpd(:25)
-> content_filter(:10024) -> smtpd(:10025)", in which the
latter 10025 does not have another Amavis content_filter.</p>
<p>Additional mail flows may be necessary such as for your DKIM
use-case, e.g. "<a class="moz-txt-link-abbreviated" href="mailto:sender@internal.domain">sender@internal.domain</a> -> smtpd(:submission)
-> content_filter(:10026) -> smtpd(:10025)", so Port 10026
would have to be bound by Amavis, not Postfix.</p>
<p>As Matus has written, other constellations are possible.</p>
<blockquote type="cite"
cite="mid:91cfb927-3e75-4a05-ac96-774392273044@howitts.co.uk">Do I
just duplicate the two sections starting 127.0.0.1, changing the
ports but leave the first smtp-amavis section?
<br>
</blockquote>
I don't see a use-case for smtpd(:10026) here. <br>
</body>
</html>