Thanks Wietse and Viktor!
On 2015-04-17 at 02:39 Wietse Venema wrote:
The solution for you would be that:
1) Postfix always records the original recipient, regardless of the
enable_original_recipient setting, so that address verification
works.
2) The enable_original_recipient parameter determines whether the
original address will be used for address deduplication and
whether it will show up in X-Original-To: headers, maillog
records, and so on. This requires that a bunch of tests be
replaced by with other tests. We can even introduce finer-grained
control (enable_original_recipient = x-original-to, deduplication,
logging, ...).
I would love to see this solution in an upcoming postfix release as it
would simplify my setup and help to make it more robust.
Meanwhile, I have successfully tested two workarounds:
(1) Split up the verification and relay to Dovecot into separate
Postfix instances using postmulti:
verify +----------------+ verify
+---------->| postfix-verify |----------+
| (group1@) +----------------+ (user1@) |
| v
ext +---------+ +----------------+
------->| postfix | | dovecot (LMTP) |
+---------+ +----------------+
| ^
| relay +----------------+ relay |
+---------->| postfix-relay |----------+
(group1@) +----------------+ (user1@)
This actually does the job, but the Linux distribution support
for postmulti is not satisfying - OpenSUSE has no postmulti support
apart from shipping the binary and manpage, RHEL7/CentOS7/OEL7 tries
to start the instances, but fails at the pidfiles. Debian at least
succeeds starting the instances.
None of the above has a concept to share common parts of the
main.cf among the instances and updating the actual main.cf at
(re-)starts/reloads.
Since I do not want to synchronize the configs manually, I decided for
workaround option (2):
(2) relay_recipient_maps
I have disabled recipient address validation and I'm querying
directly the LDAP directory in order to check which recipients
are valid on the Dovecot server - not nice, but seems to work.
Thanks,
Mathias.
