Re: How getmail deals with delivery errors and with bounce e-mails

On Tue, 2020-11-03 at 10:06 +0100, R. Diez wrote:
> In any case, I am trying to set up an internal mail server like that
> many people did in the past with Microsoft Exchange and its "POP 
> Connector". This internal mail server is not exposed to the Internet
> and should carry on working internally if the Internet connection 
> breaks down. I understand that it may not be economical, but I thought
> I might just do it for fun, and hopefully learn something along the
> way.
> 
I have a similar system. Here's what I do:

Inbound mail
============

1) Use getmail to fetch mail from my ISP. I do this so there are NO
inbound channels through my firewall: getmail fetches all inbound mail
from my ISP by connecting to the ISP's MTA and asking for any new mail:
if there is any, it pulls it off the ISP's server and closes the link.
This is unlike an MTA, which just listens on an open port, waiting for
messages to be sent to it.  

2) getmail passes all mail to Spamassassin. anything it scores as spam
gets written to a quarantine directory. New spam items are reported by a
daily logwatch script and spam entries more than a week old are deleted.

3) nonspam gets handed to postfix.sendmail which passes it to my local
master MTA, a copy of Postfix running on an always-on house server. Any
mail with an invalid destination address is redirected to my main
personal mailbox by Postfix. My choice: I configured it to do this.

4) My master MTA passes inbound mail (after redirection as needed) to a
copy of Dovecot, also on my house server, for collection by MUAs on the
various hosts on my LAN.

getmail-->spamassassin-->spamkiller-- ham -->sendmail-->Postfix
                             |                            |
                             |                            | 
                             +- spam ---> quarentine      v
                                             |           Dovecot--> MUA
                                             |
                                             +-deleted after 7 days

Outbound mail
=============
1) All hosts on my LAN run a copy of Postfix. These are configured to
send mail passed to them (mostly system status reports, etc) to the MTA
on my house server. Internal mail gets redirected to Dovecot for
collection by the various MUAs in my LAN. Outbound mail is sent directly
to my ISP for onward transmission. 

from MUA 
or system messages --->local MTA--->main MTA--- outbound ---> ISP
                                           |
                                           |
                                       local delivery
                                           |
                                           *--> Dovecot ---> MUA

> I thought that the whole point of a multidrop mailbox is that the
> internal mail server would process all e-mails and generate bounce 
> messages if necessary.
> 
As Charles said, anything you accept from outside is now your
responsibility to deliver internally or dispose of: your choice
entirely, but once its been accepted you MUST NOT reject it.

If you don't want to do that, don't use getmail. Instead, nominate a
master MTA for your LAN and have it accept an SMTP stream from your ISP.
This requires you to have an open port in your firewall so that your ISP
can send inbound messages to your main MTA. This setup does allow you to
reject messages. If you're going to reject mail you MUST run incoming
mail through blacklisters, greylisters, spamassassin or whatever that
decide whether mail is to be accepted or rejected and tag it accordingly
before passing it to your main MTA - this then makes the binary choice
of either rejecting or accepting an incoming message.
  
Martin