For the Postfix bit, I already have:
#=====================================================================
# Global antivirus/antispam pre-filter (Amavis)
#=====================================================================
smtp-amavis unix - - n - 5 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20
# SMTP interface for injecting mail into Amavis
127.0.0.1:10025 inet n - n - - smtpd
-o content_filter=smtp-amavis:[127.0.0.1]:10024
-o smtpd_restriction_classes=
-o smtpd_client_restrictions=
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
-o strict_rfc821_envelopes=yes
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
#=====================================================================
# Mail re-injection (after pre-filtering)
#=====================================================================
127.0.0.1:10026 inet n - n - - smtpd
-o content_filter=
-o smtpd_restriction_classes=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
So you removed the submission service?
A "usual" mail flow is "[email protected] -> smtpd(:25) ->
content_filter(:10024) -> smtpd(:10025)", in which the latter 10025 does
not have another Amavis content_filter.
Additional mail flows may be necessary such as for your DKIM use-case,
e.g. "[email protected] -> smtpd(:submission) ->
content_filter(:10026) -> smtpd(:10025)", so Port 10026 would have to be
bound by Amavis, not Postfix.
As Matus has written, other constellations are possible.
Do I just duplicate the two sections starting 127.0.0.1, changing the
ports but leave the first smtp-amavis section?
I don't see a use-case for smtpd(:10026) here.
