Re: How getmail deals with delivery errors and with bounce e-mails

> [...]
> I do this so there are NO inbound channels through my firewall

Excellent, that is exactly what I want to achieve, mainly because of security concerns.


> getmail fetches all inbound mail
> from my ISP by connecting to the ISP's MTA and asking for any new mail:
> if there is any, it pulls it off the ISP's server and closes the link.

If I understood you and the mail terminology correctly, you are not actually asking the ISP's MTA, but you are connecting to the  mail 
provider's IMAP server. Is that right? getmail only supports POP3 and IMAP4 after all.

Are you polling for new mails at regular intervals, or using IMAP IDLE?


> 2) getmail passes all mail to Spamassassin. anything it scores as spam
> gets written to a quarantine directory. New spam items are reported by a
> daily logwatch script and spam entries more than a week old are deleted.


I guess that's fine, but I wanted to rely on the mail provider's spam filtering. At least for now. That would save me work, and I trust the 
provider more than my current mail server skills.


> 3) nonspam gets handed to postfix.sendmail

Do you mean that getmail runs the version of sendmail that Postfix provides?

If so, could you give me an example configuration? That would save me some research time.


> which passes it to my local master MTA, a copy of Postfix running on an always-on house server.
> Any mail with an invalid destination address is redirected to my main
> personal mailbox by Postfix.

How does Postfix know whether a destination address is invalid?


> 4) My master MTA passes inbound mail (after redirection as needed)

How does Postfix know that a redirection is needed?

What happens at this point if redirection is not needed, but the recipient e-mail address does not exist?


> Outbound mail
> =============
> 1) All hosts on my LAN run a copy of Postfix. These are configured to
> send mail passed to them (mostly system status reports, etc) to the MTA
> on my house server.

That would be a simple Postfix configuration so send local mail to the "master" MTA (yet another Postfix). Is that right? Could you give me 
an example of such a configuration? Yes, I probably am a little lazy. O8-)


> Internal mail gets redirected to Dovecot for
> collection by the various MUAs in my LAN. Outbound mail is sent directly
> to my ISP for onward transmission.

OK, so the main MTA server (Postfix) has a rule to distinguish between internal e-mails and outbound e-mails. May I ask for an example of 
such a configuration? I would be forever grateful. ;-)


> As Charles said, anything you accept from outside is now your
> responsibility to deliver internally or dispose of: your choice
> entirely, but once its been accepted you MUST NOT reject it.

Why not? We can already send "on vacation" automatic replies.

I am missing a piece of the puzzle here. Are there different rejection "levels" or "stages"? I am thinking that the SMTP mail server at my 
provider may accept a connection, start receiving an e-mail, stop in the middle, and tell the SMTP client that the recipient does not exist. 
Then the SMTP client (coming from somewhere on the Internet) will be the one generating a bounce e-mail for the original Thunderbird user, 
right?

Or does the SMTP mail server at my provider always take the whole e-mail, and then discard it (because the recipient e-mail address is 
unknown) and finally generate a bounce e-mail itself?

If I am using a "catch all" mailbox at my provider, I cannot reject e-mails straight away (during the first SMTP connection that brought the 
mail) without duplicating all e-mail accounts on the provider's mail server, which I want to avoid if possible.

So I must generate bounce e-mails later on. What is the reason behind the "you MUST NOT reject" rule? Because that is the only way I could 
get bounce e-mails working, as far as I can see.


> [...]
> Instead, nominate a master MTA for your LAN and have it accept
> an SMTP stream from your ISP.

The whole point of this learning exercise is to avoid opening a port in my firewall. I am very afraid! 8-)

Thanks for your help,
   rdiez