tegwick
ab3346d187
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 252470@bnt-lap001 Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241
74 lines
2.2 KiB
Markdown
74 lines
2.2 KiB
Markdown
---
|
|
id: MAS-WP-0004
|
|
type: workplan
|
|
title: "MAS Postfix integration profile"
|
|
domain: communication
|
|
repo: mail-address-semantics
|
|
status: proposed
|
|
owner: claude
|
|
topic_slug: coulomb-social
|
|
created: "2026-10-18"
|
|
updated: "2026-10-18"
|
|
origin: residual
|
|
origin_ref: MAS-WP-0003
|
|
state_hub_workstream_id: "bf5eebc0-3b97-5c78-9c3a-58834258744e"
|
|
---
|
|
|
|
# MAS Postfix integration profile
|
|
|
|
Decision-gate outcome of MAS-WP-0002 (founder, 2026-10-18). MAS-WP-0003
|
|
showed that a default Postfix silently drops every P2 (`!`) address, and
|
|
that the correct relay configuration is not obvious
|
|
(`docs/experiment-review.md`, operational findings). Turn the working
|
|
setup in `deploy/railiance/entrypoint.sh` into a documented, tested
|
|
integration profile.
|
|
|
|
## Extract the profile
|
|
|
|
```task
|
|
id: MAS-WP-0004-T01
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "e1d1c1fb-b34e-5ea3-98e5-10556b80a83b"
|
|
```
|
|
|
|
Write a standalone Postfix profile (main.cf/master.cf fragments plus
|
|
the relay regexp) for a MAS receiving domain:
|
|
- explicit `@DOMAIN` relay regexp, ending the restriction list in `reject`;
|
|
- `allow_untrusted_routing=yes`, `swap_bangpath=no` and `allow_percent_hack=no`;
|
|
- pipe to `mas-gateway`;
|
|
- optional authenticated relay with a send cap;
|
|
- null-sender discard;
|
|
- sender authentication: OpenDKIM (verify) + OpenDMARC milters,
|
|
annotate-only. Forged A-R headers for the host's authserv-id are
|
|
stripped with a Postfix `header_checks` IGNORE rule, because OpenDKIM's
|
|
`RemoveARFrom` did not work in testing. The milters run in the
|
|
foreground (MAS-WP-0005 T11; spec §14 item 10).
|
|
Explain each setting and say why the stock config fails.
|
|
|
|
## Probe the profile
|
|
|
|
```task
|
|
id: MAS-WP-0004-T02
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "dcdf491a-3be8-566e-8111-c496a7970b4b"
|
|
```
|
|
|
|
Extend `experiments/postfix-probe/` to run the profile against the full
|
|
address corpus. Include the relay negatives (`x@other`, `x!y@other`,
|
|
`a@other@DOMAIN`, `a@DOMAIN@other`) and P2 forms. Make it part of the test
|
|
suite where Docker is available.
|
|
|
|
## Exim notes
|
|
|
|
```task
|
|
id: MAS-WP-0004-T03
|
|
status: todo
|
|
priority: low
|
|
state_hub_task_id: "a3ddf4f1-6b21-5ee7-8dae-4926fcf4181e"
|
|
```
|
|
|
|
Check whether Exim has equivalent pitfalls for `!`/`%` local-parts and
|
|
record the needed settings. Build an Exim profile only if there is
|
|
demand.
|