How to use Postal when you have an Antispam Gateway on premises?

[viniciusferrao]

Hello, I'm reading the docs and I understand that Postal can send and receive messages, however I could not find any information on how I should deploy Postal in an environment where I already have an Anti-spam gateway (for incoming only messages; and optional outgoing) and a classic/cloud mail server.

I can think of Postal running behind the anti-spam gateway. My MX entries on DNS will still be the gateway where it relays the incoming messages to Postal. Postal can send it directly to the internet without passing the gateway since if I understood correctly it can do proper signing with DKIM.

But for deliverability reasons I see that Postal can use a smart host, in our case I would use Microsoft 365 with HVE (High Volume Email) feature, however I understand that I can lose some functionality as described here: #497

I see there's information for the outgoing side, like here: https://github.com/orgs/postalserver/discussions/2546; however I could not find anything from the incoming side.

So what are the supported (and recommended) deployment scenarios for Postal?

For incoming:

• Internet -> Postal
• Internet -> On-prem anti-spam -> Postal
• Internet -> Cloud Gateway -> On-prem anti-spam -> Postal

Outgoing:

• Postal -> Internet
• Postal -> Any relay -> Internet

Thanks all.

[willpower232]

I don't know too much about incoming messages for Postal. If you're just expecting bounce messages then its probably less of a concern than if you were using routing within Postal to handle all sorts of incoming messages. As long as the original headers survive whatever chain of servers are before Postal it should be fine.

In an ideal situation, you would be able to get Postal to use your anti spam (presuming it is compatible with spamd, rspamd, or clamav) then it could just be directly on the internet and be responsible to analysing its own messages.

postal/doc/config/yaml.yml

Lines 183 to 211 in fd3c7cc

	rspamd:
	# Enable rspamd for message inspection
	enabled: false
	# The hostname of the rspamd server
	host: 127.0.0.1
	# The port of the rspamd server
	port: 11334
	# Enable SSL for the rspamd connection
	ssl: false
	# The password for the rspamd server
	password:
	# Any flags for the rspamd server
	flags:
	spamd:
	# Enable SpamAssassin for message inspection
	enabled: false
	# The hostname for the SpamAssassin server
	host: 127.0.0.1
	# The port of the SpamAssassin server
	port: 783
	clamav:
	# Enable ClamAV for message inspection
	enabled: false
	# The host of the ClamAV server
	host: 127.0.0.1
	# The port of the ClamAV server
	port: 2000

I'm not familiar with that variety of Microsoft 365 but I don't think Postal supports using authentication for outgoing email relays so you may be out of luck there. The feature seems to mostly be related to allowing mails to leave a locked-down network rather than using a completely remote server on the other side of the internet.

[viniciusferrao]

Hmm, the best way to discover is testing. I'll do an installation and try to find out.