Fine-tuning IPv6 and IPv4 support per service

[TheOneWithTheBraid]

Summary

I would like to expand the configuration options about IPv4 and IPv6 support on the level of single services.

E.g., someone might be able to receive mails on IPv6 only but want to be able to send mails on IPv4 and IPv6 or in my use case, receive mails on IPv4 and IPv6 but only send them on IPv4.

Motivation

Sadly IPv4 and IPv6 coverage in many places still is cursed nowadays. As a mailserver administrator in cursed environments, I might like to limit certain services to using IPv4 or IPv6 while neither disabling either of them globally. In my use-case, I'm not able to configure reverse DNS on IPv6 but on IPv4 only which is why I can only send mails via IPv4. Other setups might have different constraints such as public IPv6 only etc. I'd therefore propose to add easier configuration on enabling or disabling IPv4 or IPv6 on base of each service individually.

Additional context

No response

[mkuron]

In my use-case, I'm not able to configure reverse DNS on IPv6 but on IPv4 only which is why I can only send mails via IPv4.

I agree, in that scenario you cannot use IPv6 for outgoing SMTP connections. I can't think of any other situations though where it matters whether IPv4 or v6 is used, so per-service fine-tuning shouldn't be required. All you need is a switch in Postfix that tells it to accept incoming IPv6 connections but only use IPv4 for outgoing connections. According to https://www.postfix.org/postconf.5.html#smtp_address_preference, that can be done by changing the beginning of data/conf/postfix/master.cf like this:

# inter-mx with postscreen on 25/tcp
smtp       inet  n       -       n       -       1       postscreen
  -o inet_protocols=ipv4
10025      inet  n       -       n       -       1       postscreen
...

[dphi]

Some providers, like OVH with their VPS offering, assign /128 addresses. These /128 addresses are in /64 which are on block lists, e.g. by the popular Spamhaus lists. I believe there is an opportunity to detect cases like missing reverse dns and ipv6 /128 assignments in blocked /64 and recommend to disable IPv6 for outgoing email connections automatically.

Was this already considered?

[mkuron]

You could certainly submit a pull request to add such detection to the generate_config.sh script.

[apio-sys]

Some providers, like OVH with their VPS offering, assign /128 addresses. These /128 addresses are in /64 which are on block lists, e.g. by the popular Spamhaus lists. I believe there is an opportunity to detect cases like missing reverse dns and ipv6 /128 assignments in blocked /64 and recommend to disable IPv6 for outgoing email connections automatically.

Was this already considered?

I had this issue previously with OVH with a /128 assigned to a VPS which is of course bad practice and I haven't seen this elsewhere fortunately. Indeed, the smallest IPv6 network (and not address) to be assigned should never be less than /64. What you can do in such a case, is disabling IPv6 in postfix for sending only. Create or add to an existing data/conf/postfix/extra.cf with the following:

smtp_address_preference = ipv4
smtp_bind_address = [your_ipv4_address]

and restart postfix and verify the status of your containers:

docker compose restart postfix-mailcow
docker compose up -d

Your outgoing mail now will only use IPv4. Not sure how you could automate this since the reverse DNS could still be valid even though a /128 is assigned.