Christopher J. Buckley

This quick article concerns using the relayhost variable to allow postfix to relay into the submission port (587), rather than the smtp port (25).

When using a separated tier network of postfix servers, ie - a cluster at the front, which receive from a cluster in a segmented network, you will need to use the relayhost variable to daisy link the two clusters together. Usually, you may be tempted to simply submit on port 25. This was previously acceptable, but now a concerted drive is being made towards the correct port - 587. When using DKIM implementations such as DKIM proxy mail will not be signed on port 25 without some hackery in master.cf [this is strongly advised against]. As Jason states:

. . .The point is we don’t want to sign mail from untrusted sources, and that’s what could happen if you direct that mail through dkimproxy.out.

So how do we ensure our chain of servers signs mail submitted? Easy!

relayhost = [smtp.domain.tld]:587

You can now sit back and watch as all your mail is digitally signed by what-ever DKIM implementation you have chosen.