From 2ef1045700933efb423ceaf24a650cecdd11316f Mon Sep 17 00:00:00 2001 From: Marvin Winkler Date: Mon, 28 Sep 2026 12:06:59 +0200 Subject: [PATCH] amavis: treat POSTFIX_RELAY_DOMAINS as local domains MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit amavis only considers a recipient "local" if its domain is in @local_domains_acl, which Debian defaults to .$mydomain (/etc/mailname). For every relayed domain amavis therefore logged {RelayedOpenRelay} and — because it only adds X-Spam-* headers and the spam subject tag for local recipients — the SpamAssassin verdict never reached the mailbox. With amavis enabled, the relay domains (and their subdomains) are now also amavis' local domains: mail is logged {RelayedInbound}, gets X-Spam-Flag / X-Spam-Status, and spam above the tag2 level gets the subject tag. Still delivered (final_spam_destiny stays D_PASS). Co-Authored-By: Claude Opus 5.5 --- README.md | 1 + scripts/entrypoint.sh | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/README.md b/README.md index ec807f8..ff562a8 100644 --- a/README.md +++ b/README.md @@ -176,6 +176,7 @@ __OFFICIAL ENVIRONMENT VARIABLES__ - POSTFIX_RELAY_DOMAINS - specify certain domains which will be relayed (by default all mails will be forwarded) + - with amavis enabled these domains (and their subdomains) are also amavis' local domains, so incoming mail for them gets spam headers (`X-Spam-*`, subject tag at `AMAVIS_SA_TAG2_LEVEL_DEFLT`) - POSTFIX_MYDESTINATION - specify the domains which this mail-gateway handles (I recommend to use only POSTFIX_RELAY_DOMAINS) diff --git a/scripts/entrypoint.sh b/scripts/entrypoint.sh index 31a3226..9ef8d35 100755 --- a/scripts/entrypoint.sh +++ b/scripts/entrypoint.sh @@ -289,6 +289,18 @@ EOF if [ ! -z ${POSTFIX_RELAY_DOMAINS+x} ]; then echo ">> POSTFIX set relay_domains = $POSTFIX_RELAY_DOMAINS" postconf -e "relay_domains=$POSTFIX_RELAY_DOMAINS" + + # amavis only treats a recipient as "local" (spam headers, subject tag, + # {RelayedInbound} instead of {RelayedOpenRelay}) if its domain is in + # @local_domains_acl, which Debian defaults to .$mydomain (/etc/mailname) + # only. The relayed domains are exactly the ones this gateway receives + # mail for, so make them local — with subdomains (leading dot). + if [ -z ${DISABLE_AMAVIS+x} ]; then + AMAVIS_LOCAL_DOMAINS=$(echo "$POSTFIX_RELAY_DOMAINS" | tr ', ' '\n\n' | grep . \ + | sed 's/^\.//; s/.*/".&"/' | tr '\n' ',' | sed 's/,$//') + echo ">> AMAVIS set @local_domains_acl = ( \".\$mydomain\", $AMAVIS_LOCAL_DOMAINS )" + sed -i '/^1;/i @local_domains_acl = ( ".$mydomain", '"$AMAVIS_LOCAL_DOMAINS"' );' /etc/amavis/conf.d/50-user + fi fi if [ -d /etc/postfix/additional/opendkim ]; then