Z MX server

All domain name MX records should point to one of our MX server {a,b,c}.mx.mayfirst.org.

However, some membes use App River to filter viruses and spam and then configure App River to relay on to May First. This causes one major problem: Our MX servers will not be able to properly run DMARC and SPF checks because we can’t properly determine what the last hop was.

To resolve this problem we have a special MX server (z.mx.mayfirst.org) that is firewalled to only allow connections via App River and it bypasses all DMARC and SPF checks. Otherwise, it behaves exactly the same as the other MX servers.

The configuration is simple and handled by hand. Any member that wishes to use this server:

  • May First adds their domain name to /etc/postfix/z-relay-domains (and run postmap on it)
  • The members configures App River to deliver to z.mx.mayfirst.org
  • Set the MX record in our control with verified set to 1 (it doesn’t matter where it points)

Handling bounces

To do.

See: https://code.mayfirst.org/mfmt/seed-inventory/-/issues/86