mail-address-semantics/workplans/MAS-WP-0004-postfix-integration-profile.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	origin	origin_ref	state_hub_workstream_id
MAS-WP-0004	workplan	MAS Postfix integration profile	communication	mail-address-semantics	finished	claude	coulomb-social	2026-10-18	2026-10-19	residual	MAS-WP-0003	bf5eebc0-3b97-5c78-9c3a-58834258744e

MAS Postfix integration profile

Decision-gate outcome of MAS-WP-0002 (founder, 2026-10-18). MAS-WP-0003 showed that a default Postfix silently drops every P2 (!) address, and that the correct relay configuration is not obvious (docs/experiment-review.md, operational findings). Turn the working setup in deploy/railiance/entrypoint.sh into a documented, tested integration profile.

Extract the profile

id: MAS-WP-0004-T01
status: done
priority: high
state_hub_task_id: "e1d1c1fb-b34e-5ea3-98e5-10556b80a83b"

Write a standalone Postfix profile (main.cf/master.cf fragments plus the relay regexp) for a MAS receiving domain:

• explicit @DOMAIN relay regexp, ending the restriction list in reject;
• allow_untrusted_routing=yes, swap_bangpath=no and allow_percent_hack=no;
• pipe to mas-gateway;
• optional authenticated relay with a send cap;
• null-sender discard;
• sender authentication: OpenDKIM (verify) + OpenDMARC milters, annotate-only. Forged A-R headers for the host's authserv-id are stripped with a Postfix header_checks IGNORE rule, because OpenDKIM's RemoveARFrom did not work in testing. The milters run in the foreground (MAS-WP-0005 T11; spec §14 item 10). Explain each setting and say why the stock config fails.

Probe the profile

id: MAS-WP-0004-T02
status: done
priority: high
state_hub_task_id: "dcdf491a-3be8-566e-8111-c496a7970b4b"

Extend experiments/postfix-probe/ to run the profile against the full address corpus. Include the relay negatives (x@other, x!y@other, a@other@DOMAIN, a@DOMAIN@other) and P2 forms. Make it part of the test suite where Docker is available.

Exim notes

id: MAS-WP-0004-T03
status: done
priority: low
state_hub_task_id: "a3ddf4f1-6b21-5ee7-8dae-4926fcf4181e"

Check whether Exim has equivalent pitfalls for !/% local-parts and record the needed settings. Build an Exim profile only if there is demand.

Outcome

• Profile: integrations/postfix/install.sh and README.md. The live deployment (deploy/railiance/entrypoint.sh) now uses it.
• Probe: probe.py --profile mas-profile --corpus, run in pytest as tests/test_postfix_profile.py where Docker is available. Every corpus address arrives unchanged up to RFC 5321 quoting: Postfix adds quotes around non-dot-atoms (.bernd becomes ".bernd"), and those are still invalid MAS. All relay negatives get 554.
• Not redeployed: the running mas-mx pod still uses the image built before this change. The new entrypoint sets the same Postfix settings through the profile and takes effect on the next image build. MAS-WP-0007 (retirement) no longer waits on this workplan.
• Exim: integrations/exim/NOTES.md. The stock ACL rejects !/% for local domains. No profile is built, because there is no demand yet.