``Postfix`` IP address settings

[Mischback]

Research, evaluate and then document IP address-related settings of Postfix.

Relevant Settings

• [x] inet_interfaces
• smtp_bind_address
  • not tested
  • assumed to be working like smtp_bind_address6
• [x] smtp_bind_address6
• smtp_bind_address_enforce
  • available from Postfix > 3.7
  • not tested, as Debian/stable (bullseye) only includes 3.5
  • left in main.cf.sample with a clarifying comment
• inet_protocols
  • not tested
• smtp_address_preference
  • not tested

Required Test Cases

• inet_interfaces set to a specific IP
  • Is that IP used for all inbound and outbound connections?
  • This would be the most obvious and easy configuration
• inet_interfaces set to a specific IP + localhost
  • Is the IP used for all inbound and outbound connections? At least the external ones?
  • This would be the most desirable configuration (easy, obvious, functional)
• inet_interfaces set to all in combination with smtp_bind_address6
  • Is smtp_bind_address6 used for all outbound connections?!
• inet_interfaces set to all in combination with smtp_bind_address6 and multiple available IPv6 interfaces.
  • Verify smtp_bind_address_enforce. I feel like this should be set to yes.

Notes

• if inet_interfaces is set to an actual IP address (v4 or v6), Postfix binds itsself only to that interface (see ss -lntp output)
• inet_intonly to the specified interfaceserfaces might be a list, e.g. 192.168.100.5, 127.0.0.1, [::1]
• if inet_interfaces is set to all and inet_protocols is set to ipv6, Postfix binds itsself to IPv6 interfaces only (see ss -lntp output)

Original Issue Statement

Postfix might be tied to a dedicated IPv4/IPv6 address.

This will make SPF/DMARC/... possible without too much interdependent settings with other services.

Highly relevant for an IPv6 setup, that maintains scalability.

See https://serverfault.com/questions/92181/how-to-make-postfix-use-another-ip-address#92207

Originally posted by @Mischback in https://github.com/Mischback/mailsrv/issues/13#issuecomment-1293650333

[Mischback]

inet_interfaces = [PUBLIC IPv6],[::1]

• [OK] binds Postfix only to the specified interfaces (ss -lntp)
• [FAIL] connect to other mailserver comes still from the default address!

[Mischback]

inet_interfaces = [Public IPv6],[::1],127.0.0.1 smtp_bind_address6 = [Public IPv6]

• [OK] binds Postfix only to the specified interfaces (ss -lntp)
• [OK] uses the specified Public IPv6 while connecting to other mailserver

[Mischback]

inet_interfaces = all smtp_bind_address6 = [Public IPv6]

• [OK] binds Postfix to all interfaces, as expected (ss -lntp)
  • 0.0.0.0:25, [::]:25 (and for :587)
• [OK] uses the specified Public IPv6 while connecting to other mailserver