🐳 docker mailサーバ構築

やりたいこと

独自ドメイン宛のメールをGmailに転送

Gmail内から独自ドメインで返信

メールサーバ1台で異なるドメインのアドレスを一括管理

作業

事前にMXレコードとAレコードを登録しておく

リポジトリ上のREADMEを参照しながら進める

$ mkdir mail && cd mail

$ wget "${DMS_GITHUB_URL}/compose.yaml"

$ wget "${DMS_GITHUB_URL}/mailserver.env"

$ wget "${DMS_GITHUB_URL}/setup.sh"

$ chmod a+x ./setup.sh

docker-composeのhostnameとdomainnameを変更しろと記載がある

$ vim comopose.yaml

ドメインに適当なものを設定する

※最終的に10.0.0.1のサーバからメールが送付され、そのAレコードがmail.example.comなのであれば、メールサーバのホスト名もこれと一致させる必要がある

転送設定にはenvファイルにてSMTP_ONLY=1するらしい

$ vim mailserver.env

SMTP_ONLY=1

SSL_TYPE=letsencryptとかもできるようだが証明書発行の閾値を超えると嫌なので安定稼働まではSSL無効(空欄)のまま進める

ユーザを追加していないがSMTP_ONLYの場合不要らしいのでコンテナを起動してみる

$ docker comopse up -d

起動はした。

aliasの追加を忘れていた。起動後でも問題ないか不明だがとりあえず追加する

$ ./setup.sh alias add from@domain to@domain

テストメールを送付してみる

エラーで帰ってきた

サーバに対してポートスキャンしてみる→ポートは開いている

一度止める

$ docker comopse down

アカウントを追加する

$ ./setup.sh email add name@domain password

起動する

$ docker compose up -d

テストメールを送付する

対象サーバのメールシステムからエラーメッセージが飛んできた

サービスとしては動いていそうだが、転送に失敗している。Gmailへの転送は色々と準備が必要なのでそれ関連と思われる

dkimを作成

$ ./setup.sh config dkim

txtレコードを設定

$ cat ./docker-data/dms/config/opendkim/keys/domain/mail.txt

原因切り分けのためaliasを追加

$ ./setup.sh alias add from@domain to@domain2

Gmail側のエラーは別要因だった。転送に関しては動いていそう。認証周りはまだ動いていないので要調査。

仕方がないので掻い摘んで読むこととする。

コンテナ起動後数秒で再起動を繰り返している。SSL_TYPE=letsencryptを指定すると再現しているように思える。

証明書取得時になにかエラーを吐いているかもしれない。

→ ディレクトリPATHの指定に誤りがあっただけだった

動いた

ポイントを列挙する

SSL_TYPE=letsencryptのみで証明書を取得するかのように記述されているが動かない

以下のコマンドで証明書を自力で持ってくる必要があった

$ docker run --rm -it -v "$(PWD)/mail/docker-data/certbot/certs/:/etc/letsencrypt/" -v "$(PWD)/mail/docker-data/certbot/logs/:/var/log/letsencrypt/" -p 80:80 certbot/certbot renew«

既存のHTTPサーバとポートが重複している→80番ポートの使用を直ちにやめる

ついでにcrontabに登録しておく

code:crontab

0 4 1 * * docker run --rm -it -v "/home/docker/mail/docker-data/certbot/certs/:/etc/letsencrypt/" -v "/home/docker/mail/docker-data/certbot/logs/:/var/log/letsencrypt/" -p 80:80 certbot/certbot renew«

Googleへ転送するには「SPF」「DMARC」「DKIM」の設定が必要。何れかが欠けている場合迷惑メール行きまたは破棄となる。

https://scrapbox.io/files/6275bb1ec61ca00021c86fad.png

DKIMではドメイン毎に鍵を発行し、TXTレコードとして各ドメインに登録する

$ ./setup.sh config dkim domain <DOMAIN NAME>

cat ./docker-data/dms/config/opendkim/keys/<DOMAIN.TLD>/mail.txt

自前で権威DNSを運用している場合はそのままゾーンファイルにコピペすればOK

mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "

"p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwuRecCLC9kmhN+JsUqwxEuLJdVUD5O3FU79X3kAw1MN+2McLYUwmMR9z9dynCsiweTBZ9BbaWqeqw2YreoOC8WUoUs7MjrkZgrIKfGat6FFSPiJS97pn4eTfmCZFik220r75uAwxb9mLGE2rTRL2uT0A338A3Qw8iYyfSWi11KIxuMCNsJgv9IQ04rgKwfYQ6FALk9lhR2hD06"

"Yoivdo6dEQvAh36aKF2DleWhFVOM5kPYrsDh2fdl/CUvlIQoKYKrWRcBI9AndtRp+EQ+ceE7Y3+YIvjQggZJ9yX4lTRj0I7gLzomNu5tamjtzOBsMl+grNQcWZtLIq1HWm3TqmuL8HR56EZoGS6OBkGJh5TvDLlxbbXyv70UpODNQDQk/ynwlKZ6kZd5eZK4WeL5BuH1+HbzXjvhDoFPybWk7/ypf+SHnwSOple4/hhy9gRFF6VZfdMQZG"

"AXsUVv+dTMN/XjuYMH3RyEyKPrwAKom1W4nWhuRL2TPdlrxy0OKc+g9zL/EWzlWIheujEbaC2+U/tnKDarOYu0l9/V7danS8h7VAYL8t1mg1PG46/dqGX1r+uGSPtP9JbwJyISL/Mw/cQtEsF5d7CQEXIsCcX77P3xr4nSl8dZ1a0ciana1xTr4PGuO2MuWoA1jAprT0oXGa5e56w4eO74AO/iOH1nxKHlkCAwEAAQ==" ) ; ----- DKIM key mail for <DOMAIN NAME>

Cloudflareなどにレコード登録する場合は括弧内のものをつなげて登録する。⇓みたいな感じでValueに登録

v=DKIM1; h=sha256; k=rsa; p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwuRecCLC9kmhN+JsUqwxEuLJdVUD5O3FU79X3kAw1MN+2McLYUwmMR9z9dynCsiweTBZ9BbaWqeqw2YreoOC8WUoUs7MjrkZgrIKfGat6FFSPiJS97pn4eTfmCZFik220r75uAwxb9mLGE2rTRL2uT0A338A3Qw8iYyfSWi11KIxuMCNsJgv9IQ04rgKwfYQ6FALk9lhR2hD06 Yoivdo6dEQvAh36aKF2DleWhFVOM5kPYrsDh2fdl/CUvlIQoKYKrWRcBI9AndtRp+EQ+ceE7Y3+YIvjQggZJ9yX4lTRj0I7gLzomNu5tamjtzOBsMl+grNQcWZtLIq1HWm3TqmuL8HR56EZoGS6OBkGJh5TvDLlxbbXyv70UpODNQDQk/ynwlKZ6kZd5eZK4WeL5BuH1+HbzXjvhDoFPybWk7/ypf+SHnwSOple4/hhy9gRFF6VZfdMQZG AXsUVv+dTMN/XjuYMH3RyEyKPrwAKom1W4nWhuRL2TPdlrxy0OKc+g9zL/EWzlWIheujEbaC2+U/tnKDarOYu0l9/V7danS8h7VAYL8t1mg1PG46/dqGX1r+uGSPtP9JbwJyISL/Mw/cQtEsF5d7CQEXIsCcX77P3xr4nSl8dZ1a0ciana1xTr4PGuO2MuWoA1jAprT0oXGa5e56w4eO74AO/iOH1nxKHlkCAwEAAQ==

mail._domainkeyの場合、「mail」をセレクタと呼ぶ。

セレクタと同名のサブドメイン(この場合mail)とメールサーバのIPをAレコードで関連付ける必要がある

SPFは以下を登録する

v=spf1 mx ~all

DMARCは以下を登録する

v=DMARC1; p=none; rua=mailto:<MAILADDRESS>; ruf=mailto:<MAILADDRESS>; sp=none; ri=86400

MXレコードにはメールサーバのFQDNを登録する

転送設定を行ったアドレスのInboxにはメールが保存されない (転送先のメールボックスにのみメールファイルが保存される)

メール送付テスト(メーラにログインしても良いが手間なので以下で済ませる)

docker compose exec mailserver sh -c "echo '<BODY>' | mail -s '<SUBJECT>" -r <FROM MAILADDRESS> <TO MAILADDRESS>"

引っかかった点は多分これくらい

TO-DO：思い出したら書き足す、時間を見つけて情報を整理する

設定ファイルとか

code:compose.yml

services:

mailserver:

image: docker.io/mailserver/docker-mailserver:latest

container_name: mailserver

# If the FQDN for your mail-server is only two labels (eg: example.com),

hostname: mail

domainname: <MYDOMAIN>

env_file: mailserver.env

# More information about the mail-server ports:

# To avoid conflicts with yaml base-60 float, DO NOT remove the quotation marks.

ports:

- "25:25" # SMTP (explicit TLS => STARTTLS)

# - "143:143" # IMAP4 (explicit TLS => STARTTLS)

- "465:465" # ESMTP (implicit TLS)

# - "587:587" # ESMTP (explicit TLS => STARTTLS)

- "993:993" # IMAP4 (implicit TLS)

volumes:

- ./docker-data/dms/mail-data/:/var/mail/

- ./docker-data/dms/mail-state/:/var/mail-state/

- ./docker-data/dms/mail-logs/:/var/log/mail/

- ./docker-data/dms/config/:/tmp/docker-mailserver/

- /etc/localtime:/etc/localtime:ro

- ./docker-data/certbot/certs/:/etc/letsencrypt

restart: always

stop_grace_period: 1m

cap_add:

- NET_ADMIN

- SYS_PTRACE

code:mailserver.env

# -----------------------------------------------

# --- Mailserver Environment Variables ----------

# -----------------------------------------------

# DOCUMENTATION FOR THESE VARIABLES IS FOUND UNDER

# -----------------------------------------------

# --- General Section ---------------------------

# -----------------------------------------------

# => Specify a fully-qualified domainname to serve mail for. This is used for many of the config features so if you can't set your hostname (e.g. you're in a container platform that doesn't let you) specify it in this environment variable.

OVERRIDE_HOSTNAME=

# REMOVED in version v11.0.0! Use LOG_LEVEL instead.

DMS_DEBUG=0

# Set the log level for DMS.

# This is mostly relevant for container startup scripts and change detection event feedback.

#

LOG_LEVEL=info

# critical => Only show critical messages

# error => Only show erroneous output

# **warn** => Show warnings

# info => Normal informational output

# debug => Also show debug messages

SUPERVISOR_LOGLEVEL=

# 0 => mail state in default directories

ONE_DIR=1

# empty => postmaster@domain.com

# => Specify the postmaster address

POSTMASTER_ADDRESS=<YOUR MAIL ADDRESS>

# Check for updates on container start and then once a day

# If an update is available, a mail is sent to POSTMASTER_ADDRESS

# 0 => Update check disabled

# 1 => Update check enabled

ENABLE_UPDATE_CHECK=1

# Customize the update check interval.

# Number + Suffix. Suffix must be 's' for seconds, 'm' for minutes, 'h' for hours or 'd' for days.

UPDATE_CHECK_INTERVAL=1d

# Set different options for mynetworks option (can be overwrite in postfix-main.cf)

# The same can happen for rootless podman. To prevent this, set the value to "none" or configure slirp4netns

#

# none => Explicitly force authentication

# container => Container IP address only

# host => Add docker container network (ipv4 only)

# network => Add all docker container networks (ipv4 only)

# connected-networks => Add all connected docker networks (ipv4 only)

PERMIT_DOCKER=none

# Set the timezone. If this variable is unset, the container runtime will try to detect the time using

TZ=

# In case you network interface differs from 'eth0', e.g. when you are using HostNetworking in Kubernetes,

# you can set NETWORK_INTERFACE to whatever interface you want. This interface will then be used.

# - **empty** => eth0

NETWORK_INTERFACE=

# empty => modern

# modern => Enables TLSv1.2 and modern ciphers only. (default)

# intermediate => Enables TLSv1, TLSv1.1 and TLSv1.2 and broad compatibility ciphers.

TLS_LEVEL=

# Configures the handling of creating mails with forged sender addresses.

#

# empty => (not recommended, but default for backwards compatibility reasons)

# Mail address spoofing allowed. Any logged in user may create email messages with a forged sender address.

# 1 => (recommended) Mail spoofing denied. Each user may only send with his own or his alias addresses.

SPOOF_PROTECTION=

# - **0** => Disabled

# - 1 => Enabled

ENABLE_SRS=0

# 1 => Enables POP3 service

# empty => disables POP3

ENABLE_POP3=

ENABLE_CLAMAV=0

# Amavis content filter (used for ClamAV & SpamAssassin)

# 0 => Disabled

# 1 => Enabled

ENABLE_AMAVIS=1

# -1/-2/-3 => Only show errors

# **0** => Show warnings

# 1/2 => Show default informational output

# 3/4/5 => log debug information (very verbose)

AMAVIS_LOGLEVEL=0

# Note: Emails will be rejected, if they don't pass the block list checks!

# **0** => DNS block lists are disabled

# 1 => DNS block lists are enabled

ENABLE_DNSBL=1

# cap_add:

# - NET_ADMIN

ENABLE_FAIL2BAN=0

# Fail2Ban blocktype

# drop => drop packet (send NO reply)

# reject => reject packet (send ICMP unreachable)

FAIL2BAN_BLOCKTYPE=drop

# 1 => Enables Managesieve on port 4190

# empty => disables Managesieve

ENABLE_MANAGESIEVE=

# **enforce** => Allow other tests to complete. Reject attempts to deliver mail with a 550 SMTP reply, and log the helo/sender/recipient information. Repeat this test the next time the client connects.

# drop => Drop the connection immediately with a 521 SMTP reply. Repeat this test the next time the client connects.

# ignore => Ignore the failure of this test. Allow other tests to complete. Repeat this test the next time the client connects. This option is useful for testing and collecting statistics without blocking mail.

POSTSCREEN_ACTION=enforce

# empty => all daemons start

# 1 => only launch postfix smtp

SMTP_ONLY=

#

# empty => SSL disabled

# letsencrypt => Enables Let's Encrypt certificates

# custom => Enables custom certificates

# manual => Let's you manually specify locations of your SSL certificates for non-standard cases

# self-signed => Enables self-signed certificates

SSL_TYPE=letsencrypt

# Provide the path to your cert and key files that you've mounted access to within the container.

SSL_CERT_PATH=

SSL_KEY_PATH=

# Optional: A 2nd certificate can be supported as fallback (dual cert support), eg ECDSA with an RSA fallback.

# Useful for additional compatibility with older MTA and MUA (eg pre-2015).

SSL_ALT_CERT_PATH=

SSL_ALT_KEY_PATH=

# Set how many days a virusmail will stay on the server before being deleted

# empty => 7 days

VIRUSMAILS_DELETE_DELAY=

# This Option is activating the Usage of POSTFIX_DAGENT to specify a lmtp client different from default dovecot socket.

# empty => disabled

# 1 => enabled

ENABLE_POSTFIX_VIRTUAL_TRANSPORT=

# Enabled by ENABLE_POSTFIX_VIRTUAL_TRANSPORT. Specify the final delivery of postfix

#

# empty => fail

# etc.

POSTFIX_DAGENT=

# Set the mailbox size limit for all users. If set to zero, the size will be unlimited (default).

#

# empty => 0

POSTFIX_MAILBOX_SIZE_LIMIT=

# 0 => Dovecot quota is disabled

# 1 => Dovecot quota is enabled

ENABLE_QUOTAS=1

# Set the message size limit for all users. If set to zero, the size will be unlimited (not recommended!)

#

# empty => 10240000 (~10 MB)

POSTFIX_MESSAGE_SIZE_LIMIT=

# Mails larger than this limit won't be scanned.

# ClamAV must be enabled (ENABLE_CLAMAV=1) for this.

#

# empty => 25M (25 MB)

CLAMAV_MESSAGE_SIZE_LIMIT=

# Enables regular pflogsumm mail reports.

# This is a new option. The old REPORT options are still supported for backwards compatibility. If this is not set and reports are enabled with the old options, logrotate will be used.

#

# not set => No report

# daily_cron => Daily report for the previous day

# logrotate => Full report based on the mail log when it is rotated

PFLOGSUMM_TRIGGER=

# Recipient address for pflogsumm reports.

#

# not set => Use REPORT_RECIPIENT or POSTMASTER_ADDRESS

# => Specify the recipient address(es)

PFLOGSUMM_RECIPIENT=<YOUR MAIL ADDRESS>

#

# not set => Use REPORT_SENDER

# => Specify the sender address

PFLOGSUMM_SENDER=

# Interval for logwatch report.

#

# none => No report is generated

# daily => Send a daily report

# weekly => Send a report every week

LOGWATCH_INTERVAL=weekly

# Recipient address for logwatch reports if they are enabled.

#

# not set => Use REPORT_RECIPIENT or POSTMASTER_ADDRESS

# => Specify the recipient address(es)

LOGWATCH_RECIPIENT=<YOUR MAIL ADDRESS>

#

# not set => Use REPORT_SENDER

# => Specify the sender address

LOGWATCH_SENDER=

# Defines who receives reports if they are enabled.

# **empty** => ${POSTMASTER_ADDRESS}

# => Specify the recipient address

REPORT_RECIPIENT=<YOUR MAIL ADDRESS>

# Defines who sends reports if they are enabled.

# **empty** => mailserver-report@${DOMAINNAME}

# => Specify the sender address

REPORT_SENDER=

# Changes the interval in which log files are rotated

# **weekly** => Rotate log files weekly

# daily => Rotate log files daily

# monthly => Rotate log files monthly

#

# Note: This Variable actually controls logrotate inside the container

# and rotates the log files depending on this setting. The main log output is

# respective container name). If you want to control logrotation for

# the Docker-generated logfile see:

#

LOGROTATE_INTERVAL=weekly

# Choose TCP/IP protocols for postfix to use

# **all** => All possible protocols.

# ipv4 => Use only IPv4 traffic. Most likely you want this behind Docker.

# ipv6 => Use only IPv6 traffic.

#

POSTFIX_INET_PROTOCOLS=all

# Choose TCP/IP protocols for dovecot to use

# **all** => Listen on all interfaces

# ipv4 => Listen only on IPv4 interfaces. Most likely you want this behind Docker.

# ipv6 => Listen only on IPv6 interfaces.

#

DOVECOT_INET_PROTOCOLS=all

# -----------------------------------------------

# --- SpamAssassin Section ----------------------

# -----------------------------------------------

ENABLE_SPAMASSASSIN=1

# deliver spam messages in the inbox (eventually tagged using SA_SPAM_SUBJECT)

SPAMASSASSIN_SPAM_TO_INBOX=1

# KAM is a 3rd party SpamAssassin ruleset, provided by the McGrail Foundation.

# If SpamAssassin is enabled, KAM can be used in addition to the default ruleset.

# - **0** => KAM disabled

# - 1 => KAM enabled

#

ENABLE_SPAMASSASSIN_KAM=0

# spam messages will be moved in the Junk folder (SPAMASSASSIN_SPAM_TO_INBOX=1 required)

MOVE_SPAM_TO_JUNK=1

# add spam info headers if at, or above that level:

SA_TAG=2.0

# add 'spam detected' headers at that level

SA_TAG2=6.31

# triggers spam evasive actions

SA_KILL=6.31

# add tag to subject if spam detected

SA_SPAM_SUBJECT=***SPAM*****

# -----------------------------------------------

# --- Fetchmail Section -------------------------

# -----------------------------------------------

ENABLE_FETCHMAIL=0

# The interval to fetch mail in seconds

FETCHMAIL_POLL=300

# -----------------------------------------------

# --- LDAP Section ------------------------------

# -----------------------------------------------

# empty => LDAP authentification is disabled

# 1 => LDAP authentification is enabled

ENABLE_LDAP=

# empty => no

# yes => LDAP over TLS enabled for Postfix

LDAP_START_TLS=

# If you going to use the mailserver in combination with docker-compose you can set the service name here

# empty => mail.domain.com

# Specify the dns-name/ip-address where the ldap-server

LDAP_SERVER_HOST=

# empty => ou=people,dc=domain,dc=com

# => e.g. LDAP_SEARCH_BASE=dc=mydomain,dc=local

LDAP_SEARCH_BASE=

# empty => cn=admin,dc=domain,dc=com

# => take a look at examples of SASL_LDAP_BIND_DN

LDAP_BIND_DN=

# empty** => admin

# => Specify the password to bind against ldap

LDAP_BIND_PW=

# => Specify how ldap should be asked for users

LDAP_QUERY_FILTER_USER=

# => Specify how ldap should be asked for groups

LDAP_QUERY_FILTER_GROUP=

# => Specify how ldap should be asked for aliases

LDAP_QUERY_FILTER_ALIAS=

# => Specify how ldap should be asked for domains

LDAP_QUERY_FILTER_DOMAIN=

# -----------------------------------------------

# --- Dovecot Section ---------------------------

# -----------------------------------------------

# empty => no

# yes => LDAP over TLS enabled for Dovecot

DOVECOT_TLS=

DOVECOT_USER_FILTER=

DOVECOT_PASS_FILTER=

# Define the mailbox format to be used

# default is maildir, supported values are: sdbox, mdbox, maildir

DOVECOT_MAILBOX_FORMAT=maildir

# empty => no

# yes => Allow bind authentication for LDAP

DOVECOT_AUTH_BIND=

# -----------------------------------------------

# --- Postgrey Section --------------------------

# -----------------------------------------------

ENABLE_POSTGREY=0

# greylist for N seconds

POSTGREY_DELAY=300

# delete entries older than N days since the last time that they have been seen

POSTGREY_MAX_AGE=35

# response when a mail is greylisted

POSTGREY_TEXT="Delayed by Postgrey"

# whitelist host after N successful deliveries (N=0 to disable whitelisting)

POSTGREY_AUTO_WHITELIST_CLIENTS=5

# -----------------------------------------------

# --- SASL Section ------------------------------

# -----------------------------------------------

ENABLE_SASLAUTHD=0

# empty => pam

# Note: can be a list of mechanisms like pam ldap shadow

SASLAUTHD_MECHANISMS=

# empty => None

# e.g. with SASLAUTHD_MECHANISMS rimap you need to specify the ip-address/servername of the imap server ==> xxx.xxx.xxx.xxx

SASLAUTHD_MECH_OPTIONS=

# empty => Use value of LDAP_SERVER_HOST

# Note: since version 10.0.0, you can specify a protocol here (like ldaps://); this deprecates SASLAUTHD_LDAP_SSL.

SASLAUTHD_LDAP_SERVER=

# empty => Use value of LDAP_BIND_DN

# specify an object with priviliges to search the directory tree

# e.g. active directory: SASLAUTHD_LDAP_BIND_DN=cn=Administrator,cn=Users,dc=mydomain,dc=net

# e.g. openldap: SASLAUTHD_LDAP_BIND_DN=cn=admin,dc=mydomain,dc=net

SASLAUTHD_LDAP_BIND_DN=

# empty => Use value of LDAP_BIND_PW

SASLAUTHD_LDAP_PASSWORD=

# empty => Use value of LDAP_SEARCH_BASE

# specify the search base

SASLAUTHD_LDAP_SEARCH_BASE=

SASLAUTHD_LDAP_FILTER=

# empty => no

# yes => LDAP over TLS enabled for SASL

# If set to yes, the protocol in SASLAUTHD_LDAP_SERVER must be ldap:// or missing.

SASLAUTHD_LDAP_START_TLS=

# empty => no

# yes => Require and verify server certificate

# If yes you must/could specify SASLAUTHD_LDAP_TLS_CACERT_FILE or SASLAUTHD_LDAP_TLS_CACERT_DIR.

SASLAUTHD_LDAP_TLS_CHECK_PEER=

# File containing CA (Certificate Authority) certificate(s).

# empty => Nothing is added to the configuration

SASLAUTHD_LDAP_TLS_CACERT_FILE=

# Path to directory with CA (Certificate Authority) certificates.

# empty => Nothing is added to the configuration

SASLAUTHD_LDAP_TLS_CACERT_DIR=

# Specify what password attribute to use for password verification.

SASLAUTHD_LDAP_PASSWORD_ATTR=

# empty => No sasl_passwd will be created

SASL_PASSWD=

SASLAUTHD_LDAP_AUTH_METHOD=

# Specify the authentication mechanism for SASL bind

# empty => Nothing is added to the configuration

SASLAUTHD_LDAP_MECH=

# -----------------------------------------------

# --- SRS Section -------------------------------

# -----------------------------------------------

# envelope_sender => Rewrite only envelope sender address (default)

# header_sender => Rewrite only header sender (not recommended)

# envelope_sender,header_sender => Rewrite both senders

# An email has an "envelope" sender (indicating the sending server) and a

# "header" sender (indicating who sent it). More strict SPF policies may require

# you to replace both instead of just the envelope sender.

SRS_SENDER_CLASSES=envelope_sender

# empty => Envelope sender will be rewritten for all domains

# provide comma separated list of domains to exclude from rewriting

SRS_EXCLUDE_DOMAINS=

# empty => generated when the image is built

# provide a secret to use in base64

# you may specify multiple keys, comma separated. the first one is used for

# signing and the remaining will be used for verification. this is how you

# rotate and expire keys

SRS_SECRET=

# -----------------------------------------------

# --- Default Relay Host Section ----------------

# -----------------------------------------------

# Setup relaying all mail through a default relay host

#

# empty => don't configure default relay host

# default host and optional port to relay all mail through

DEFAULT_RELAY_HOST=

# -----------------------------------------------

# --- Multi-Domain Relay Section ----------------

# -----------------------------------------------

# Setup relaying for multiple domains based on the domain name of the sender

# optionally uses usernames and passwords in postfix-sasl-password.cf and relay host mappings in postfix-relaymap.cf

#

# empty => don't configure relay host

# default host to relay mail through

RELAY_HOST=

# empty => 25

# default port to relay mail

RELAY_PORT=25

# empty => no default

# default relay username (if no specific entry exists in postfix-sasl-password.cf)

RELAY_USER=

# empty => no default

# password for default relay user

RELAY_PASSWORD=

参考