Qmail Patching Makes me Nervous

Solution 1:

This is typically addressed on the network layer, where all outbound SMTP would be source NAT'd to the same IP.

The definitive source for QMAIL's official distribution is Qmail.org, which is where you could acquire netqmail. netqmail is QMAIL packaged with recommended patches that were commonly applied, as there had not been an official release in a while.

There are numerous patches linked on QMAIL's web site, which change the interface binding behavior. I have successfully implemented this patch in a production environment before, which allows different domains to use different IPs.

The patch isn't documented that well but I have the following in my notes:

   outgoingips
        IP addresses to be used on outgoing connections.   Each  line  has
        the  form fromdomain:localip, without any extra spaces.  If domain
        matches the domain part  in  sender,  qmail-remote  will  bind  to
        localip  when connecting to host.  If it matches, it will also set
        the HELO string to the domain part of sender.

Changing your MTA's behavior will likely be impacting in some way but how that impact affects your services is going to depend on your deployment plan. If nothing else, QMAIL will need to be restarted, which will briefly impact delivery.

Compiling from source and patching is slightly more advanced but if you are standardized on QMAIL and need this feature, you are not going to have many options unless you want to pay someone else to do it for you.

Your existing users and e-Mail should not be affected but if your QMAIL installation has other patches, such as those that allow authentication data to be stored in a database, you may need further patches to duplicate your existing functionality. If you are using "stock" QMAIL 1.03 it should be rather straight forward.

Solution 2:

Some additions to Warner's advice (sorry but I don't have enough reputation to use the comment function):

• The qmail setup that comes with Plesk is already highly patched, however Parallels offers the source as well as any patches applied together with rather good documentation in its knowledge base.

• Beware: Patches that not only change the outgoing IP address but also the host name are considered harmful, if an IP shares more than one hostname. There a couple of MX hosts that stop receiving mails from hosts which connect using different HELO strings.

• You're talking about qmail reading "the primary server IP and domain and reports that when sending emails from the system". In fact, those are different things. While choosing a different IP address for outgoing connections, you can simply set the hostname used for saying HELO in /var/qmail/control/me.

• Regarding the problem itself: Please provide the exact error message you receive from target MX hosts, as I guess you're mixing up things here. It is perfectly acceptable to send mail from a different host than the host offering the website of a domain being its MX host. There is also no direct correlation between the HELO string and the 'from' address of a mail, unless the recipient implements some really brain-dead anti-spam "solution".

Solution 3:

I have the same problem, i.e. I have a multi-homed host (6 IPs) and several domains binding to each IP.

Qmail uses a single hostname and IP address for the sending IP/Host but for hosts with multiple domains/IPs there are two issues:

1. Some mail servers reject mail if the senders From field domain does not match whats in the envelope

2. From a design view point Qmail should do by default what outgoingips does;

Plesk comes up with updates constantly and some of the updates are applied to Plesk's patches to qmail so one has to make sure nothing else breaks; if Qmail did this problem would not exist.