smtpd.conf

#	$OpenBSD: smtpd.conf,v 1.11 2018/06/04 21:10:58 jmc Exp $

# This is the smtpd server system-wide configuration file.
# See smtpd.conf(5) for more information.


# Options
#
queue	compression
queue	encryption \
	5101bef20f4d02c826bffc243e15a7c0 # `openssl rand -hex 16`
queue	ttl \
	4d
bounce	warn-interval \
	1h, 6h, 2d # default: 4h
smtp	max-message-size \
	35M # (!) match "quota_max_mail_size" from 90-quota.conf
mta	max-deferred \
	100
# Pass the message through Rspamd and delegate message delivery to Dovecot LDA
mda	wrapper	dovecot \
	"rspamc -h /var/run/rspamd/rspamd.sock \
		-t 120 \
		--mime \
		-e '%{mda}'"


# PKI
#
pki	mercury.example.com \
	cert "/etc/ssl/acme/mercury.example.com.fullchain.pem"
pki	mercury.example.com \
	key "/etc/ssl/acme/private/mercury.example.com.key"


# Tables
#
# Local host aliases
table	aliases \
	file:/etc/mail/aliases
#
# Virtual host aliases
table	virtuals \
	file:/etc/mail/virtual
#
# Virtual domains
table	vdomains \
	file:/etc/mail/vdomains
#
# Virtual passwd
table	passwd \
	passwd:/etc/mail/passwd
#
# Blacklist sender's address or entire @example.bad
table	blacklist \
	file:/etc/mail/blacklist
#
# Local sender's entire @mailname (or local hostname)
table	localhost \
	{ "@mercury.example.com" }
#
# Local session HELO/EHLO for mda, lmtp, and smtp level notifications
table	localhelo \
	{ "localhost", "mercury.example.com" }
#
# OpenPGP WKS Submission Address
table	submission-address \
	file:/var/www/openpgpkey/submission-address
#
# Source IP addresses of relays that may legitimately originate mail ...
table	relays \
	file:/etc/mail/relays
# ... with our email address or entire @vdomains as the sender
table	whitelist \
	file:/etc/mail/whitelist


# Incoming connections
#
# Local messages
listen	on socket
#
# DKIM signed messages (dkimproxy_out relay)
listen	on lo0 port 10028 \
	tag DKIM
#
# Mail Transfer Agent (opportunistic STARTTLS)
listen	on egress port 25 \
	tls pki mercury.example.com \
	tag MTA #no-dsn
#
# Message Submission Agent (Implicit TLS)
listen	on egress port 465 \
	smtps pki mercury.example.com \
	auth <passwd> received-auth mask-src \
	tag MSA
#
# Message Submission Agent requires STARTTLS and authentication
listen	on egress port submission \
	tls-require pki mercury.example.com \
	auth <passwd> received-auth mask-src \
	tag MSA


# Dispatchers
#
# Relay the message to any MX using opportunistic STARTTLS
action	"relay" \
	relay
#
# Relay the message as backp MX using mandatory STARTTLS with valid certificate
action	"backup" \
	relay backup tls
#
# Relay the message to dkimproxy_out listen address:port
action	"dkim" \
	relay host smtp://127.0.0.1:10027
#
# Only accept the message if alias to a remote address
action	"forward" \
	forward-only \
	alias <aliases>
#
# Deliver the message to Dovecot LMTP using "virtuals" virtual expansion
action	"lmtp" \
	lmtp "/var/dovecot/lmtp" rcpt-to \
	virtual <virtuals>
#
# Delegate message delivery to wrapper "dovecot" using virtual expansion
action	"mda" \
	mda "/usr/local/libexec/dovecot/dovecot-lda \
		-a %{rcpt} \
		-d %{dest} \
		-f %{mbox.from}" \
	virtual <virtuals> \
	wrapper "dovecot"


# Rules (first match wins)
#
# Local messages to forward
match	from local \
	for local \
	action "forward"
#
# Local messages for virtual domains to MDA (or backup MX)
match	from local \
	!mail-from <blacklist> \
	for domain <vdomains> \
	action "mda" # "backup", "lmtp", or "mda"
#
# DKIM signed messages to MTA
match	tag DKIM \
	from src 127.0.0.1 \
	for any \
	action "relay"
#
# Reject forged messages that claim to be from the local domain
match	tag MTA \
	!from src <relays> \
	mail-from <whitelist> \
	for any \
	reject
#
# External messages for virtual domains to MDA (or backup MX)
# (!) WKS Trust Management: reject foreign Key Submission request
match	tag MTA \
	from any \
	!mail-from <blacklist> \
	for domain <vdomains> \
	!rcpt-to <submission-address> \
	action "mda" # "backup", or "mda"
#
# Outgoing messages (from auth users) to dkimproxy_out for signing
# (!) do not accept mail FROM local host and IP, nor FOR local domain
match	tag MSA \
	!from local \
	!mail-from <localhost> \
	!for local \
	auth \
	action "dkim"
#
# Outgoing messages (DSN and MDN with empty reverse path "MAIL FROM: <>")
# from localhost to dkimproxy_out for signing (RFC1123 section 5.2.9)
match	!tag MSA \
	helo <localhelo> \
	from local \
	!for local \
	!mail-from <localhost> \
	action "dkim"