How to access original recipient in sieve scripts

[SapuSeven]

Hi,
I have docker-mailserver configured with a catch-all mailbox as described in the FAQ by editing postfix-virtual.cf:

@example.com user1@example.com

Now I want to perform some actions on specific recipient-addresses, e.g. messages to fun@example.com should be moved to the folder Fun.

I tried a sieve script like this:

if envelope :localpart "To" "fun"{
[... do stuff]
}

but it didn't work.

To debug, I tried the following script:

if envelope :matches "To" "*" {
  fileinto "${1}";
}

just to see where it ends up, and looking at the result it always ends up in user1@example.com.
In the logs, I can also see a line like this:

postfix/smtp-amavis/smtp[131332]: 312321321: to=<user1@example.com>, orig_to=<fun@example.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.48, delays=0.27/0.02/0.01/0.18, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 123123123)

Apparently, the envelope filter in the sieve script is always looking at the final to-address.

Is there any way to make filtering with a catch-all by to-address possible?

[polarathene]

I think I came across a solution for that when I was writing up these notes, skip to near the end under the user-and-cc-local-alias.txt section.

Those parts should have relevant links.

You can shell into the DMS container running and use nano /etc/postfix/master.cf to edit that config, with postfix reload after saving to refresh those settings.

Virtual aliases like you'd use for your catch-all should be managed by virtual, which we configure by default to deliver through lmtp to Dovecot:

docker-mailserver/target/scripts/startup/setup.d/postfix.sh

Line 82 in a815bf5

postconf 'virtual_transport = lmtp:unix:/var/run/dovecot/lmtp'

Thus the advice should be related to master.cf adding those extra config settings to lmtp:

docker-mailserver/target/postfix/master.cf

Line 74 in a815bf5

lmtp unix - - n - - lmtp

When you know the settings you need, they can be added to our postfix-master.cf config file to apply for you when the container starts. (EDIT: Seems like you will need to handle a change that it doesn't support unfortunately)

postfix-master.cf is fed into a postconf command (postconf -P each_line_here). So instead you'll have to opt for our user-patches.sh support for now (let us know if you get it working):

#!/bin/bash

# Required for the Postfix to send with original recipient headers for Sieve to use:
# Change from default limit of 50 to 1,
# Postfix will send mail with multiple recipients to Dovecot one at a time
# instead of delegating to Dovecot to manage all at once:
postconf lmtp_destination_recipient_limit=1

# Modify the `lmtp` service to use the `lmtp` transport command with extra `flags=DO` arg:
# This will enable both `Delivered-To:` and `X-Original-To` headers for Sieve to have access:
postconf -F 'lmtp/unix/command=lmtp flags=DO'

Those two commands you could use in the DMS container like I described earlier for testing, and if they work then persist that via user-patches.sh.

There might be some other settings you'd need to look into, and the Sieve script maybe needs to look at those newly added headers instead, should be the X-Original-To that you want.

I don't have time to investigate further than I did in my link, or apply the advice I'm providing here to verify unfortunately, but I'd appreciate hearing back what works for you so others can benefit, it'd also help towards a feature request issue for someone to contribute a feature/docs for 👍

[SapuSeven]

Thanks a lot for your detailed investigation and explanation!
I tested the proposed changes (lmtp_destination_recipient_limit and lmtp flags), now there's an X-Original-To header present in the message, but it has the same value as the To-address (in my case user1@example.com).

[SapuSeven]

Alright, I am really not qualified enough to further debug this issue, so until someone has a better idea I will use a global sieve script that I found here:
https://community.mailcow.email/d/1081-catchall-and-x-original-to-header/5

It takes the original to-address from the X-Spamd-Result header.
It's quite an ugly hack and I have no idea how it handles multiple recipients, but it works well enough for my purpose.

I also needed to add the editheader sieve extension in dovecot config: sieve_global_extensions = +editheader

[polarathene]

Yeah sorry, I'm not aware of any other maintainer familiar with Sieve and related service config to get the headers applied. I assume it's possible, just might require a fair amount of time experimenting with configs.

You only mentioned the X-Original-To header, and not the Delivered-To header? The descriptions I shared above indicate they're potentially different. The envelope recipient should be the original one, and from the sounds of it with X-Original-To it may be after it resolved the alias.

---

It takes the original to-address from the X-Spamd-Result header.

That actually might be worth looking into too. If you disable anti-spam so that header isn't present (ENABLE_AMAVIS=0), this will skip a little dance of sending the mail arriving to Amavis, which then sends it back to Postfix afterwards re-queuing it for actual delivery.

Potentially the virtual alias may have already been resolved before that latter step, so disabling Amavis may reveal that issue. Then we just need to figure out the extra config changes to accommodate that. The alternative anti-spam service is rspamd which is implemented differently via a Postfix milter instead of content filter, thus doesn't do that transport dance.

Clearly that information was at least available earlier if you're getting it from that header :)

---

Beyond those two avenues to investigate, I only shared how to configure that final delivery via lmtp. There is similar settings supported by other transports/services in master.cf that could occur earlier where it may be relevant if neither of the above suggestions are successful.

[FeeeeK]

Hi, just tried setting all this up, but I also got the same values in the headers:

Delivered-To: spam@axd1x8a.me
X-Original-To: spam@axd1x8a.me
To: me@axd1x8a.me

[polarathene]

I also got the same values in the headers

Context? Did you have Amavis disabled?

Did you try any of my other suggestions?

[SapuSeven]

Another update:
For some reason, the Spamd header workaround stopped working. I looked at the headers and noticed that PREVIOUSLY_DELIVERED was missing in spamd-results.
However, "To" now contains the address the email was originally sent to, and "Delivered-To" the final destination.
So no idea why, but now everything works as expected.

[polarathene]

So no idea why, but now everything works as expected.

Is that specifically with config change advice from this discussion applied? (I'm guessing so since you mention Delivered-To)

For reference, could you share the snippet that's working for you for others to apply? Earlier discussion has a bit to wade through, so it'll probably be helpful 😅

[SapuSeven]

I applied all the settings from your original post, then I added the spamd workaround from my last post.
I haven't changed anything since then.
Good idea with writing it down in a separate answer, I will do that when I get around to it.

[FeeeeK]

For me, the default installation already allows me to get the original address from the To header without having to change anything in the config

[polarathene]

Good idea with writing it down in a separate answer, I will do that when I get around to it.

👍 Thanks!

without having to change anything in the config

For aliases with more than one recipient? (eg: marketing@example.com => john.doe@example.com, jane.doe@example.com), or as the original example for the discussion mentions, a catch-all address @example.com => john.doe@example.com. You're getting the original full @example.com address?