What is the correct (and secure) solution to send e-mails from the host server? (relay or not)

[daks]

(in case it has its importance: running docker-mailserver in Docker rootless, DMS Postfix listening on 8025, host is Debian 12)

I have a nearly production-ready config for DMS and one of the unresolved points is: how to send e-mail from the host server?
I searched the doc and didn't find any info.

I run Postfix on the host and I simply configured it (using one of the dpkg-reconfigure already prepared scenarii) to use DNS as a relay: relayhost = [127.0.0.1]:8025.
I see that logs are relayed to DMS but it rejects them, as it should.

2024-11-06T10:05:05.088693+01:00 mail postfix/smtpd[1346]: NOQUEUE: reject: RCPT from unknown[10.0.2.2]: 554 5.7.1 <[email protected]>: Relay access denied; from=<> to=<[email protected]> proto=ESMTP helo=<host.example.com>

1. I imagine that the simpler method is to simply add the host IP (in the Docker network stack) in the my_networks of DMS Postfix config. But I don't know enough about Docker and want a secure solution:

• can this IP change? How can I set it to a value so it doesn't?
• because I host several Docker rootless apps (running in different users), is it safe or could another container running elsewhere in the host relay mails without my authorization?

2. I imagine another solution could be to use Submission port and use SASL with smtp_sasl_password_maps. This will be a little bit more complex on the host side but also on DMS and I'm not sure how it must be done (I don't remember if the login/password for SASL is just another user account or it needs a specific setup).

Any opinion on this? What do people do?
Maybe the relayhost is not at all how I should do it.

PS: I think I have a slight preference for the SASL solution which would ensure me that only the authorized host would be able to relay and no other authorized container, but I'm still looking for opinions :)

[casperklein]

1. I imagine that the simpler method is to simply add the host IP (in the Docker network stack) in the my_networks of DMS Postfix config

Take a look at PERMIT_DOCKER=host

2. I imagine another solution could be to use Submission port

That will work too. Just create an user account like you normally do or use an existing one, that you can use for that.

Any opinion on this? What do people do?

I prefer running nullmailer on the host, but postfix is also fine.

[daks]

1. I imagine that the simpler method is to simply add the host IP (in the Docker network stack) in the my_networks of DMS Postfix config

Take a look at PERMIT_DOCKER=host

Thanks, I didn't see this page.
But the big WARNING makes me think it is not a good idea to risk being an open relay

2. I imagine another solution could be to use Submission port

That will work too. Just create an user account like you normally do or use an existing one, that you can use for that.
I think I will do that

Any opinion on this? What do people do?

I prefer running nullmailer on the host, but postfix is also fine.
👍