From: Digital Mercenary For Honor on
PostFix Goddesses/Gods:

Would anyone have / be able to point me to - sample configuration &
template information for a configuration that:

- Establishes two MX's in disparate locations as the primary MX's for
some domain.
- Then spools the mail to the "real" MTA for processing.

An extra bonus would be:

- To be able to use these two MX's for outbound mail processing as
well, instead of just incoming.

I'm looking to establish two MX's in two public data centers as mail
spoolers that do almost no anti-SPAM checking except for the most basic
of filtration & envelope checking. These two MX's will then spool
"downstream" to the real MTA that then does full anti-SPAM,
anti-virus/malware, etc., etc. This configuration allows me to
disconnect my corporate offices from the Internet at will and still be
able to spool e-mail & also re-direct it manually in case of an office
failure, etc.

I eschew commercial offerings in favor of being able to code / hack
things up myself - I'm an experienced administrator, so getting
technical about PostFix is cool - just looking to cook up the best I
can by assimilating as much good information as I can. Thanks in
advance for any / all responses.

/dmfh

--
_ __ _
__| |_ __ / _| |_ 01100100 01101101
/ _` | ' \| _| ' \ 01100110 01101000
\__,_|_|_|_|_| |_||_| dmfh(-2)dmfh.cx

From: Stefan Förster on
* Digital Mercenary For Honor <dmfh> wrote:
> Would anyone have / be able to point me to - sample configuration &
> template information for a configuration that:
>
> - Establishes two MX's in disparate locations as the primary MX's for
> some domain.
> - Then spools the mail to the "real" MTA for processing.

You can do this using relay_domains and a transport_maps entry. Have a
look at:

http://www.postfix.org/STANDARD_CONFIGURATION_README.html#backup

Please do not skip the part which documents the relay_recipient_maps
feature ;)

> An extra bonus would be:
>
> - To be able to use these two MX's for outbound mail processing as
> well, instead of just incoming.

If all outgoing mail passes the downstream MTA and this MTA got a
fixed IP address, you can add this IP address (with an added /32) to
the mynetworks configuration parameter in main.cf. You can then use
the smtpd restriction "permit_mynetworks" in either
smtpd_client_restrictions, or, better, in smtpd_recipient_restrictions
to accept such mail. Please have a look at the official to get
familiar about the order of checks and their possible results.

If the downstream MTA has no fixed IP address, you can use SMTP
authentication using SASL. Have a look at:

http://www.postfix.org/SASL_README.html

> I eschew commercial offerings in favor of being able to code / hack
> things up myself - I'm an experienced administrator, so getting
> technical about PostFix is cool - just looking to cook up the best I
> can by assimilating as much good information as I can. Thanks in
> advance for any / all responses.

Your requirements sound fairly basic, don't expect this to be too much
of a challenge ;)


Cheers
Stefan
--
Stefan Förster http://www.incertum.net/ Public Key: 0xBBE2A9E9
Don't send mail to discard(a)incertum.net, I will probably never read
them.