---
id: MAS-WP-0004
type: workplan
title: "MAS Postfix integration profile"
domain: communication
repo: mail-address-semantics
status: finished
owner: claude
topic_slug: coulomb-social
created: "2026-10-18"
updated: "2026-10-19"
origin: residual
origin_ref: MAS-WP-0003
state_hub_workstream_id: "bf5eebc0-3b97-5c78-9c3a-58834258744e"
---

# MAS Postfix integration profile

Decision-gate outcome of MAS-WP-0002 (founder, 2026-10-18). MAS-WP-0003
showed that a default Postfix silently drops every P2 (`!`) address, and
that the correct relay configuration is not obvious
(`docs/experiment-review.md`, operational findings). Turn the working
setup in `deploy/railiance/entrypoint.sh` into a documented, tested
integration profile.

## Extract the profile

```task
id: MAS-WP-0004-T01
status: done
priority: high
state_hub_task_id: "e1d1c1fb-b34e-5ea3-98e5-10556b80a83b"
```

Write a standalone Postfix profile (main.cf/master.cf fragments plus
the relay regexp) for a MAS receiving domain:
- explicit `@DOMAIN` relay regexp, ending the restriction list in `reject`;
- `allow_untrusted_routing=yes`, `swap_bangpath=no` and `allow_percent_hack=no`;
- pipe to `mas-gateway`;
- optional authenticated relay with a send cap;
- null-sender discard;
- sender authentication: OpenDKIM (verify) + OpenDMARC milters,
  annotate-only. Forged A-R headers for the host's authserv-id are
  stripped with a Postfix `header_checks` IGNORE rule, because OpenDKIM's
  `RemoveARFrom` did not work in testing. The milters run in the
  foreground (MAS-WP-0005 T11; spec §14 item 10).
Explain each setting and say why the stock config fails.

## Probe the profile

```task
id: MAS-WP-0004-T02
status: done
priority: high
state_hub_task_id: "dcdf491a-3be8-566e-8111-c496a7970b4b"
```

Extend `experiments/postfix-probe/` to run the profile against the full
address corpus. Include the relay negatives (`x@other`, `x!y@other`,
`a@other@DOMAIN`, `a@DOMAIN@other`) and P2 forms. Make it part of the test
suite where Docker is available.

## Exim notes

```task
id: MAS-WP-0004-T03
status: done
priority: low
state_hub_task_id: "a3ddf4f1-6b21-5ee7-8dae-4926fcf4181e"
```

Check whether Exim has equivalent pitfalls for `!`/`%` local-parts and
record the needed settings. Build an Exim profile only if there is
demand.

## Outcome

- Profile: `integrations/postfix/install.sh` and `README.md`. The live
  deployment (`deploy/railiance/entrypoint.sh`) now uses it.
- Probe: `probe.py --profile mas-profile --corpus`, run in pytest as
  `tests/test_postfix_profile.py` where Docker is available. Every corpus
  address arrives unchanged up to RFC 5321 quoting: Postfix adds quotes
  around non-dot-atoms (`.bernd` becomes `".bernd"`), and those are still
  invalid MAS. All relay negatives get 554.
- Exim: `integrations/exim/NOTES.md`. The stock ACL rejects `!`/`%` for
  local domains. No profile is built, because there is no demand yet.