Is it possible to add multiple mail accounts one user?

[AlperShal]

Hi! An app I am using accepts only one authentication but wants to be able to send mails from a few addresses.

So I have [email protected] in the app, authenticated and can send email fine. But it also want to send emails from [email protected]. What is the way to authenticate for both of these mails with one credential/user?

[AlperShal]

Four minutes later and I have found the answer lol. Even though (at least to me) documentation is not clear about this, looks like aliases are exactly doing this. So if I do: docker exec -ti mailserver setup alias add [email protected] [email protected] what I want happens.

[polarathene]

Aliases are intended for receiving mail from more than one address to a single inbox address (that you create with setup email add ...). These do work with login credentials too as a workaround for a Dovecot Quotas issue, but they're not really intended to be used as sender addresses AFAIK.

How would you suggest we improve our docs for this?

[AlperShal]

I mean, if you are saying aliases are not intended to be used for this, then there is no problem. Documentation makes it clear that aliases are made for receiving emails from an alias to your original address.

But, it looks like it's doing more than that. As [email protected] I can, beside receiving, send emails too while spoof protection is enabled. As a result, I think what gets mentioned as an alias is actually an additional email linked to your DMS account.

So we are doing this:

setup email add [email protected]

setup alias add [email protected] [email protected]

Instead of this (which looks like what is actually happening to my eyes even though what really happens could be much different):

setup user add [email protected]
setup email add [email protected] [email protected]

setup email add [email protected] [email protected]

The user command is something I made up, to present what looks like happening.

Edit: Oh also, I didn't think of the inbox. So if there is no separate inbox for the alias, then this is obviously not what I am saying happening. But if there is, it's just another email with no functionality missing, making it just another email instead of alias.

[polarathene]

Presently aliases are part of the SPOOF_PROTECTION=1 feature for checking a sender address that matches an owner/account you authenticated as. But IIRC, when you send the mail, it might resolve that alias to your actual account, so the recipient may not see the alias (or it may be in one of the mail headers (the spoof protection technically only prevents one of these being spoofed IIRC). At least I'm pretty sure Postfix virtual alias feature resolves the alias for both inbound and outbound mail, but I lack the time to verify 😓

The workaround with Dovecot enables you to login / authenticate with the alias instead of your real account address, provided the alias doesn't point to multiple addresses. This was unintentional, but for the Dovecot quotas feature Postfix does not resolve the alias before it asks Dovecot if the quota for the inbox has been exceeded, so we made dummy users for aliases that point to the real account inbox to workaround that issue. As a side effect it allows users to use an alias for authentication, but users should not rely on that.

There is a PR open that I need to review and merge, which allows custom sender addresses. At that point the alias being valid as a sender address will probably be dropped, because some users want to be able to use multiple sender addresses with a DMS account, but they don't want to use aliases for this when the authorized account (eg an admin) doesn't actually own the sender address of another DMS account/alias themselves, so they should not receive mail for that sender address, they only want the ability to send mail on behalf of some additional users.

[polarathene]

What is the way to authenticate for both of these mails with one credential/user?

setup email add [email protected] will create a DMS account, we expect it to be an email address but you can use any sender address you like after authentication on port 587 / 465, so long as you don't have SPOOF_PROTECTION=1 enabled.

The email address is your accounts inbox and where mail will be received from on port 25, but you're not restricted to what sender address you use otherwise 👍

[AlperShal]

The thing is, I need spoof protection enabled as my organization not only has service accounts but also user accounts for the members. Even though I am doing everything I can do to restrict who can send mail, someone can and probably will (best assumption for me I guess) have their credentials stolen at some point. So to protect both individuals and the organization, I need to not permit spoofing.

After adding an alias, what I wanted happened and to my understanding without weakening the security. So there shall not be any problems, right?