Mail module 1.9.1: outgoing mail rewritten by SRS (postsrsd), sender-based relay rules no longer match, mail goes out direct

Support
1

NethServer Version: nethserver8
Module: Mail 1.9.1

Setup

- NethServer 8, mail module “mail2”, images Package mail-postfix · GitHub (dovecot, rspamd, clamav also 1.9.1)

  • Node hostname: idefix.linux.local (hostnamectl / hostname -f)
  • Mail server hostname: email.benjamin-zoeller.de
  • Domains configured under Mail → Domains:linux.local

Problem:
Outgoing mail no longer uses my smarthost relay rules and is delivered directly from my (residential, dynamic) IP. web.de rejects it: 554 … No SMTP service … IP address is block listed (c=r0301) The bounce shows the envelope sender was rewritten by SRS: X-Postfix-Sender: rfc822; SRS0=nvpl=II=benjamin-zoeller.de=mail@linux.local
The original sender was mail@benjamin-zoeller.de (a normal reply sent by my mail client, with a CC to an external address at web.de). The relay did not trigger.

My relay rules are all of type “sender” :

image
image673×346 23.3 KB

Findings:

  1. Postfix Rewrites the sender via postsrsd:
    sender_canonical_maps = socketmap:unix:/var/lib/postsrsd/srs.sock:forward recipient_canonical_maps = socketmap:unix:/var/lib/postsrsd/srs.sock:reverse

  2. /etc/postsrsd/postsrsd.conf (header: “Generated by reload-config”, NethServer/dev#7741, modified Oct 20): domains-file = “/etc/postfix/postsrsd.domains” srs-domain = “linux.local”

  3. /etc/postfix/postsrsd.domains contains only:
    email.benjamin-zoeller.de.localhost
    linux.local → my sender domains (benjamin-zoeller.de, franken-connection.de) are not listed, so they are treated as foreign and rewritten.

  4. relayhost is empty. Relay works only through sender_dependent_relayhost_maps / sender_dependent_default_transport_maps (relaysender_*.cf) and transport_maps (relaydest.cf, recipient rules).

Because the sender is rewritten to SRS0=…@linux.local before relay lookup, none of my sender rules match, and the mail is sent directly.

Questions:

  • Should srs-domain really default to the node hostname domain (linux.local)?
  • Is this a regression in 1.9.x? Relay rules worked before the update (mail module containers were recreated about 2-3 weeks ago).

Thank you for your help.

2

You hit the exact interaction introduced by the postsrsd configuration in Mail 1.9.1 (NethServer/dev#7741):

  1. Why the sender-dependent relay is bypassed (sender_canonical_maps order of operations):
    In Postfix, cleanup(8) applies sender_canonical_maps (unix:/var/lib/postsrsd/srs.sock:forward) before qmgr(8) evaluates sender_dependent_default_transport_maps (relaysender_*.cf). Because /etc/postfix/postsrsd.domains only lists the domains configured under Mail → Domains (linux.local), postsrsd treats mail@benjamin-zoeller.de and franken-connection.de as foreign envelope senders and rewrites Return-Path to SRS0=...=benjamin-zoeller.de=mail@linux.local before the relay lookup runs. Once rewritten to @linux.local, your @benjamin-zoeller.de sender relay rule no longer matches, so Postfix falls back to direct MX delivery from your dynamic IP (triggering web.de’s 554 c=r0301 residential block).

  2. Cleanest fix in NS8 Mail 1.9.1:

    • Add benjamin-zoeller.de and franken-connection.de under Mail → Domains in the NS8 cluster UI (or include them in postsrsd.domains via a custom template/override inside the postfix container) so reload-config writes both domains into /etc/postfix/postsrsd.domains. Once listed in postsrsd.domains, postsrsd leaves local envelope senders untouched, allowing sender_dependent_default_transport_maps to match @benjamin-zoeller.de and route outbound mail through your All-Inkl (kasserver.com) smarthost.
    • Also set a real FQDN as your primary mail domain (or override srs-domain = benjamin-zoeller.de), because external receivers will reject SRS0=...@linux.local on non-resolvable .local envelope domains even when relayed.

  3. One extra DNS/deliverability note while you’re in there:
    Both benjamin-zoeller.de and franken-connection.de currently publish v=spf1 a mx include:spf.kasserver.com ~all, which will pass once your smarthost relay triggers again, but neither domain currently publishes a _dmarc TXT record (_dmarc.benjamin-zoeller.de). Adding v=DMARC1; p=none; rua=mailto:postmaster@benjamin-zoeller.de alongside the smarthost fix will prevent strict receivers (GMX/Web.de, Gmail, M365) from flagging alignment on forwarded/relayed mail.

3

If I would add the domains, aren’t they then treated as local domains? That would mean everything with @benjamin-zoeller.de would stay local. That would not be my intention. I just want to relay them to my hoster from that nethserver 8 instead of managing locally. How to deal with that?

Thanks

PS: As a workaround I did enter this commands:
podman exec postfix postconf -e ‘sender_canonical_maps=’
podman exec postfix postfix reload

4

Hi Linux4All,

With this fake domain and no default relay rule defined you have two alternatives:

About SRS: Mail | NethServer 8 documentation

5

Spot on — adding benjamin-zoeller.de under Mail → Domains in the NS8 UI registers it in Dovecot/Postfix as a local virtual_mailbox_domains destination, which would cause local delivery instead of relaying out when mail originates on the node.

Since you want NS8 to treat @benjamin-zoeller.de and @franken-connection.de as non-local domains and route them strictly through your per-sender smarthost rules (sender_dependent_default_transport_maps), disabling SRS persistently via the Mail module environment variable (as @davidep linked above) is the right permanent replacement for your postconf -e 'sender_canonical_maps=' workaround (which would otherwise get overwritten on the next container reload):

runagent -m mail2 systemctl --user edit --full postfix
# Or set POSTFIX_SRS=0 in the module environment and reload:
runagent -m mail2 python3 -c 'import agent; agent.set_env("POSTFIX_SRS", "0")'
runagent -m mail2 systemctl --user restart postfix

With POSTFIX_SRS=0, reload-config omits postsrsd from sender_canonical_maps permanently across upgrades while keeping your @benjamin-zoeller.de sender-based relay rules intact.