The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

    Mastodon

  • Twitter Updates

  • My Flickr Stream

    20140508-Delphi-2007--Project-Options--Cannot-Edit-Application-Title-HelpFile-Icon-Theming20140430-Fiddler-Filter-Actions-Button-Run-Filterset-now20140424-VMware-Fusion-6.0.3.-no-reclaimable
    More Photos

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,860 other subscribers
«
»

Some notes on running Postfix inside a docker container

Posted by jpluimers on 2025/11/14

The plan was to run a Postfix secondary MX inside a docker container.

Below are many links that might help me to get that going.

For now, I think this is the shortlist of solutions to try:

  • Docker Mailserver
  • Mailcow
  • Mailu

1

2

3

  • [Wayback/Archive] SPF whitelist / ignore when delivered by backup MX · Issue #787 · docker-mailserver/docker-mailserver
  • [Wayback/Archive] Backup MX Configuration for Mailcow – Don’t Miss an Email – Autoize
  • [Wayback/Archive] Best Practices | SPF – Docker Mailserver
  • [Wayback/Archive] MailCow backup MX : selfhosted

    I’m just wondering if anyone here has created a backup MX with something like Docker-MailServer or anything similar?

    I know you can create another MailCow server and set it as a a relay which will then send the stored emails when the primary MX is back up and running but my aim is to utilise a free tier based server to capture any emails any time my home server is down.

    …

    I was searching for the same thing and found this helpful comment to get `docker-mailserver` setup as a backup MX.
    github.com/docker-mailserver/docker-mailserver/issues/254#issuecomment-521184784

    Here is how i run docker-mailserver as a backup MX.

    Create postfix-main.cf in config directory and add the following:

    relay_domains = hash:/tmp/docker-mailserver/backupmx/relays
transport_maps = hash:/tmp/docker-mailserver/backupmx/transport
relay_recipient_maps = hash:/tmp/docker-mailserver/backupmx/relay_recipients
maximal_queue_lifetime = 14d

    Create a directory called backupmx and the following files relays, transport and relay_recipients.

    relays should contain the domains you would like to queue & relay mail for. E.g.

    domain1.com OK
domain2.com OK

    transport should contain the final destination mail server to relay the queued email to. E.g.

    domain1.com smtp:mail.domain1.com
domain2.com smtp:mx1.domain2.com

    relay_recipients should contain a list of valid recipients that will be accepted, queued and relayed. E.g.

    info@domain1.com OK
user@domain2.com OK

    For the above to work, the following commands must be run inside the container:

    cd /tmp/docker-mailserver/backupmx/
postmap relays
postmap transport
postmap relay_recipients
service postfix restart

    I haven’t had time to create a PR for this, but hopefully this helps someone.

    I got it working and in addition to the steps in the comment I had to add the email addresses that I wanted relayed as email accounts on the backup MX (./setup.sh email add etc.), otherwise the logs showed that the email was rejected. And of course, you have to add a mx record with a lower priority than your primary mx pointing to the backup mx.

    …

    Regarding running it on a low resource vps, it seems you can run the backup mx with the env var SMTP_ONLY=1 and `docker-mailserver` will launch with only postfix running. I haven’t done that yet and with all the usual services running (clamav, etc.), it’s using up about 1.3 GB of RAM. So with postfix only, it should be under a gig.

    …

    I get what you mean and totally agree with you, but my argument here is that a secondary MX is an optional thing and can actually be achieved with a simple Postfix config and for it to forward after a certain amount of time.

    • [Wayback/Archive] Use GMail as secondary/fallback MX for self-hosted mail server? : selfhosted

      I would like to set up a secondary MX to make sure my emails will never get lost because of connectivity issues.

      Can I abuse GMail for that? Or are there any other ways?

      …

      Also look at Amazon SES, I believe you should be able to setup it as your secondary MX and it will fit your needs. https://aws.amazon.com/ses/pricing/
      Also be forwarned while I don’t consider hosting your own email extremely complicated, many seasoned IT professionals can’t seem to figure it out. You need to have a good understanding of the fundemental concepts of email or everyone else will flag you as spam.

      [Wayback/Archive] Amazon Simple Email Service Pricing | Cloud Email Service | Amazon Web Services

      …

      Yes OP, dealing with spam and not getting blocked is the main problem. Definitely do SPF and DKIM. Use RBLs and greylisting. Otherwise you’re gonna have a bad time.

      …

      10 Years ago I would have agreed totally, but lately greylisting is becoming harder since more and more people are using companies with large email infrastructure (google, amazon, microsoft), and the retries seldom come from the same server (or even IP range) as the first try, heck, sometimes the retry might be over IPv4 instead of IPv6.
      Right now I only greylist email that soft failed SPF (or any other check that might indicate the mail is wonky, but didn’t trigger a hard fail).

      …

      There is a free backup MX service that you can use, note that they use inbound requests to help train their spam filtering service.
      This is an interesting implementation as they do a call forward to your server and if your server is online they return a temporary failure so the sender knows to retry and will hopefully hit your main server. Only if your server is offline will they actually accept mail.
      No affiliation, in fact I’ve butted heads with the operator a few times, but it does what it says on the label.

      “Junk Email Filter” was started by Marc Perkel who passed away summer 2018 [Wayback/Archive] Remembering Marc Perkel « Dvorak News Blog, so be aware there might be risk involved using the service (which could be a lot less risk than running all your mail servers by yourself):

      • [Wayback/Archive] Junk Email Filter Spam Blocking Service: Free MX EMail Server Backup Service

        … All you have to do is sign up, change your MX records, and it’s ready to go.

        Here’s how it works. Suppose your domain is “example.com” and your MX record is “mail.example.com“. You would add two more MX records as follows:

        mail.example.com 10
mxbackup1.junkemailfilter.com 20
mxbackup2.junkemailfilter.com 30

        …

        Implementation Details

        In order for this to work we have to see our backup server in your MX records. DNS propagation often take several hours and because of that this service can’t be used immediately upon changing your MX records. You should wait for several hours before testing.

        Additionally we do forward callout testing to make sure your server is actually down and we don’t pass email if your server is running. The reason for this is that we don’t want to be a back door spam source for your domain. So if your server is running we will return a 4xx error so that email will retry to your server.

        …

        Our system is not compatible with SPF so if you reject your good email based on SPF then you will lose it. SPF breaks email forwarding. All our servers however have RDNS set to*.junkemailfilter.com so you can white lists us to avoid bouncing your good email.

        Although we try to do it right sometimes things don’t work for any number of reason within and not within our control. We’re not responsible for anything lost from using our service.

        …

        So – how do we sign up?

        Signing up is easy and automatic. First we need you to join our announcement list so that we can let you know important issues and changes that we might make in the future. Then all you need to do is change your MX records.

        • [Wayback/Archive] Mxbackup Info Page

          This is an announcement list for people who are using our MX Mailserver backup system. We want you to join this list so that if we have important information to send to users of this service you will be included in the announcement. We might very rarely send you an invitation to use our spam filtering or hosted email services.

        • [Wayback/Archive] The Mxbackup Archives

          The Mxbackup ArchivesNo messages have been posted to this list yet, so the archives are currently empty.

        It is important that these two be the highest numbered two MX records and it is very important not to make our MX the lowest numbered as that is for our spam filtering customers only and our MX Backup service requires your servers be the lowest numbered MX.

        …

        In order to be compatible with our system you should disable SPF checking because SPF breaks email forwarding. You should also whitelist and avoid rate limiting on email with a reverse IP address of*.junkemailfilter.com.

        We store email up to 4 days and is rate limited to a reasonable amount so if you have a huge domain you should let us know for special arrangements. If your server goes offline then once your server comes back online we will usually detect it within minutes and transfer your email as fast as your server will accept it.

        You should also experience some spam reduction even when your server is online. Many spammers try to send spam through the backup servers. Although we don’t apply full filtering to our backup MX we do apply out light filtering rules and behavior traps and if you notice a drop in spam let us know about it. We think you should notice a significant difference. And if you like what you see you might be interested in full filtering.

        …

        Technical Details

        Our servers automatically detect your MX configuration and it verifies that we are in your high numbered MX but that we are also not lowest. That allows us to accept email for MX backup. The mxbackup1 entry points to a ring of servers in a variety of locations ready to accept and process email. The mxbackup2 MX record is really a dummy entry and it point to other servers that will always return a 421 temporary error after the DATA command. This is used for spam bot detection and feeds our blacklists after significant spam bot verification. Since spam bot don’t retry the spam is essentially blocked because they don’t come back to the real email servers.

        …

      • [Wayback/Archive] Junk Email Filter Spam Blocking Service
      • [Wayback/Archive] Junk Email Filter Spam Blocking Service: How it Works!

        “So Perkel”, you might ask, “What the hell do you do that makes your spam filter so damn good? How can you block spam better than anyone else can block spam?

      • [Wayback/Archive] Spam DNS Lists – Computer Tyme Support Wiki (even if you are not using Junk Email Filter, their Wiki is very interesting)

      …

      And in general you can’t just crate a MX record to someone’s server.
      You can buy G Suite subscription https://gsuite.google.com/learning-center/#!/ that will allow you to use gmail with your own domain once done you can follow this https://support.google.com/a/answer/33915?hl=en

      …

      Get a cheap VPS, install Debian with Postfix, and set it up to relay to your domain (don’t forget to test to make sure it only relays your domain).
      relay_domains = example.com #domains you want to store and forward mail for
smtpd_helo_required = yes
smtpd_tls_received_header = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, permit
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_rbl_client sbl-xbl.spamhaus.org
mydestination = $myhostname, localhost

#set to a time that you will get your mailserver back up within if it goes down
maximal_queue_lifetime = 4w

soft_bounce = yes
      This will accept all email for your domains including invalid users (which will fail when it tried to forward them, but it will still accept messages for them), use relay_recipient_maps if you want to only accept a certain set of addresses instead.

      …

      I have used for my domain. So far no issues
      improvmx.com

      …

      I’ve done this before with success. That’s partly why they have google apps for domains (aka G Suite). Take a look at support.google.com/a/answer/140034 to get an idea of how to setup the mx records.
      Ideally one would set them up as secondary to your primary mail exchangers but one could also set this up as the primary (thus getting the benefit of google’s antispam network plus 100.1% uptime) and having your mail servers as the secondary to handle within your own domain.

      [Wayback/Archive] Set up MX records for Google Workspace email – Google Workspace Admin Help

  • [Wayback/Archive] kubernetes | kruyt.org
    • [Wayback/Archive] Running a mailserver in Kubernetes | kruyt.org

      Running a webserver in Kubernetes is easy, but a mailserver is more challenging. Most of the challenging things has todo with your ip infrastructure, ingress and loadbalancer within Kubernetes. Here are things I learned when I was deploying a mailserver based on Postfix on Kubernetes with metallb and nginx ingress. If you have a different setup, things could apply or not.

  • [Wayback/Archive] Linux Mail Server Configuration in 10 minutes – YouTube

4

  • [Wayback/Archive] numero33/backup-mx: Simple postfix backup mailserver for your Docker containers. Based on Alpine Linux. (unmaintained but shows how simple the basics of a docker container can be).
  • [Wayback/Archive] Easy config for secondary / backup MX server · Issue #254 · docker-mailserver/docker-mailserver
  • [Wayback/Archive] Setting Up Postfix As A Backup MX isn’t about docker, but has this important remark on SPF:

    You have to set SPF record of your domain from which you send mails. If you do some form of DKIM or Domain Key, than you have to copy signing key to your backup MX.Check your backup MX IP in sites like mxtoolbox.com for blacklists and check mails from MX on dkimvalidator.com for more information what is wrong, and why your mail is labeled as SPAM.

  • [Wayback/Archive] FAQ – Docker Mailserver main topics
    • What kind of database are you using?
    • Where are emails stored?
    • How to alter the running docker-mailserver instance without relaunching the container?
    • How can I sync container with host date/time? Timezone?
    • What is the file format?
    • What about backups?
    • What about docker-data/dms/mail-state folder? (/var/mail-state internally)
    • How can I configure my email client?
    • How can I manage my custom SpamAssassin rules?
    • What are acceptable SA_SPAM_SUBJECT values?
    • Can I use naked/bare domains (no host name)?
    • Why are SpamAssassin x-headers not inserted into my subdomain.example.com subdomain emails?
    • How can I make SpamAssassin better recognize spam?
    • How can I configure a catch-all?
    • How can I delete all the emails for a specific user?
    • How do I have more control about what SPAMASSASIN is filtering?
    • What kind of SSL certificates can I use?
    • I just moved from my old Mail-Server, but “it doesn’t work”?
    • What system requirements are required to run docker-mailserver effectively?
      1 core and 1GB of RAM + swap partition is recommended to run docker-mailserver with ClamAV. Otherwise, it could work with 512M of RAM.
    • Can docker-mailserver run in a Rancher Environment?
    • How can I Authenticate Users with SMTP_ONLY?
    • Common Errors
    • How to use when behind a Proxy
    • What About Updates
    • How to adjust settings with the user-patches.sh script
    • Special use-case – Patching the supervisord config
    • How to ban custom IP addresses with Fail2ban
  • [Wayback/Archive] Backup MX store-forward : docker

    Q

    I’ve been asked to set up a simple SMTP relay in our backup datacenter to catch incoming email in the event the email filtering appliance in our primary datacenter is offline (which happened last week). Basically, all it needs to do is accept inbound emails from the internet, and forward them along to our email filter in the primary datacenter if it’s up, or hold them if the filter is down.
    I would prefer to run this as a Docker container (apologies if that’s not the correct term, I’m still relatively new) so if I needed to run multiple instances I could just bind another IP and spin up a new copy. However, all the projects I’ve found are for relaying email from inside the organization to outside mail servers. Can anyone suggest an inbound store-forward SMTP relay?

    A

    Making an image or finding an image should be pretty straight forward. Using an existing image, or build off a minimal distro using your favorite mail server, then setup the configuration correctly.
    The trick is setting the configuration correctly.
    A naïve implementation is likely to reduce the effectiveness of the spam filters on the main server. Not sure if it is still the case, but in the past many spammers would specifically target the high value MX servers since they often wouldn’t have the content filtering. And the main mail server would be configured to trust everything from the ‘backup’ server that is relaying the email.
    The primary mail server can’t reject, or bounce mail that has arrived through the ‘backup’. If it did, the bounces will probably being a source of backscatter.
    Improper configuration could also turn your backup box into a relay that could be used to send spam out to the Internet.

    Building the image+container is the easy part. Running the mail server in a way that doesn’t result in more spam getting through, or becoming a source of spam can be very complicated.

    Backscatter (email) – Wikipedia

    Backscatter (also known as outscatter, misdirected bounces, blowback or collateral spam) is incorrectly automated bounce messages sent by mail servers, typically as a side effect of incoming spam.

  • [Wayback/Archive] Perfect Backup MX using Postfix | Bots! isn’t about docker, but does refer to the original article [Wayback/Archive] linuxlasse.net :: Postfix as backup MX which explains more about SPF and TLS.
  • a

5

6

Queries

  1. [Wayback/Archive] postfix inside a docker container – Google Search
  2. [Wayback/Archive] postfix inside a docker container secondary mx – Google Search
  3. [Wayback/Archive] postfix inside a docker container “secondary mx” – Google Search
  4. [Wayback/Archive] postfix inside a docker container backup mx – Google Search
  5. [Wayback/Archive] postfix inside a docker container “backup mx” – Google Search
  6. [Wayback/Archive] postfix inside a “docker” container “backup mx” – Google Search

–jeroen

Some links as I had them open anyway:

JunkEmailFilter

Mailcow

This entry was posted on 2025/11/14 at 12:00 and is filed under *nix, *nix-tools, Cloud, Communications Development, Containers, Development, Docker, Infrastructure, Internet protocol suite, Kubernetes (k8n), postfix, Power User, SMTP. Tagged: , , , , , , . You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

«
»