Nextcloud Mail Setup

[realdadfish]

I'm new to docker-mailserver, coming from an ancient old exim4 setup that did not age well over the years. I have to say the documentation and setup procedure is par excellence so far, thank you very much for this fine piece of software!

Now, I have a very basic problem, I have a web portal (in this case Nextcloud, non-dockerized) on the same machine on which DMS runs and I want it to be able to send mail via DMS. I figured the easiest would be to create a regular mail user and restrict email receiving, so nobody can send stuff to it's inbox.

On Nextcloud's side, I configured the FQDN of the mailserver ("mail.mydomain.com"), port 25, selected STARTTLS and added the login info I created for my user.

Sending emails however fails, with this message:

Sep 26 23:03:45 mail postfix/smtpd[12142]: warning: hostname mydomain.com does not resolve to address 1.2.3.4: No address associated with hostname
Sep 26 23:03:45 mail postfix/smtpd[12142]: connect from unknown[1.2.3.4]
Sep 26 23:03:45 mail postfix/smtpd[12142]: NOQUEUE: reject: RCPT from unknown[1.2.3.4]: 554 5.7.1 <me@otherdomain.com>: Relay access denied; from=<nextcloud@mydomain.com> to=<me@otherdomain.com> proto=ESMTP helo=<nextcloud.mydomain.com>

So Nextcloud is trying to send "me@otherdomain.com" (which is an email account not managed by DMS, basically the email of the Nextcloud user I'm currently logged in with) an email and fails with the above error. I don't quite get the error message though; I have no A/AAAA record on mydomain.com, just an MX record for mail.mydomain.com and that one has a proper A/AAAA record, I hope this is not the problem?

I also configured OVERRIDE_HOSTNAME to be mail.mydomain.com, but I guess I need to "inform" DMS somehow that it should send emails for mydomain.com, other than just creating an email account via the setup script?

[polarathene]

On Nextcloud's side, I configured the FQDN of the mailserver ("mail.mydomain.com"), port 25, selected STARTTLS and added the login info I created for my user.

• Port 25 is only for delivering mail, not for submitting mail to be sent.
• Port 587 (StartTLS) or Port 465 (TLS) should be used for authenticated submission (login via account created in DMS with setup email add ...). This will allow you to submit mail as whomever (provided SPOOF_PROTECTION is the default disabled 0).

If you want to have DMS receive mail for other domains:

• They should have an MX record in DNS that points to DMS at mail.mydomain.com.
• You do not need an account created on DMS for those if you use a virtual alias (setup alias add alias_address real_address). Those can forward to an external mail server or local account created for DMS.

To accept mail on port 25 (such as for forwarding mail via alias without requiring authentication), you either need to whitelist the mail client/sender to bypass security checks, or have the mail domain (eg: @otherdomain.com) have it's DNS records (such as a TXT for SPF) permit that client to send (either by IP, A / AAAA record, etc).

• Postfix in DMS receives the mail on port 25 then and will verify that client is verified to send mail on behalf of otherdomain.com, it may also perform a rDNS PTR lookup based on the clients mail-server HELO, as only an MTA (like Postfix) should be sending mail over port 25.
• Alternatively as described earlier use authenticated submission on port 587/465 and the security checks are waivered due to trusting your credentials.

[realdadfish]

Thanks a bunch, indeed it was only the wrong port, stupid mistake of mine. Thanks again for the detailed explanation and this fantastic project!