Le Thu, Aug 27, 2026 at 01:06:13AM +0900, [email protected] a écrit : > Hi all, > > I run OpenSMTPD 7.6.0-portable on a personal debian server (alpha) with > no ports exposed to the public internet. It listens for submission on a > WireGuard interface only. Inbound mail from other MTAs arrives through > an HTTP gateway that speaks LMTP to dovecot directly. > > The reason I do this is that WireGuard is the only way through alpha > from outside. Everything else is firewalled, so port 25 is not an option > to begin with. > > smtpd therefore acts as a submission relay for my own clients plus a > local router. > > The relevant part of /etc/smtpd.conf: > > table secrets file:/etc/smtpd/secrets > table vusers file:/etc/smtpd/virtuals > > listen on lo > listen on wg0 port 587 > > action "local" lmtp "/var/run/dovecot/lmtp" rcpt-to virtual <vusers> > > action "out" relay host smtp+tls://[email protected]:2525 \ > auth <secrets> helo "dilluti0n.com" > > action "out-local" relay host smtp+tls://[email protected]:2525 \ > auth <secrets> helo "dilluti0n.com" \ > mail-from "[email protected]" > > match from any for rcpt-to "[email protected]" action > "local" > match from local for any action "out-local" > match from src 10.42.0.0/24 for any action "out" > > And /etc/smtpd/virtuals is a single line: > > [email protected] vmail > > Without the rcpt-to option on the "local" action, delivery to my own > domain failed repeatedly. From journalctl: > > 878b3aa132064ccf mda delivery evpid=b92e4508d04b1462 > from=<[email protected]> to=<[email protected]> > rcpt=<[email protected]> user=vmail delay=0s result=TempFail stat=Error > (temporary failure: "mail.lmtp: LMTP server error: 550 5.1.1 <vmail> User > doesn't exist: vmail") > > On the dovecot side, userdb key is the full address [email protected], > and mailboxes are owned by the Unix user vmail. Adding rcpt-to fixed > delivery. > > I wonder whether I am using vusers incorrectly. I understood it as the > Unix user owning the /var/run/dovecot/lmtp socket, but it appears to be > used as RCPT TO when the mail is sent over LMTP. My question is: does > <vusers> still do anything on this action, or should I drop the table > and match on the domain instead? > > Thanks, > Hee-Suk Kim > > -- > https://dilluti0n.com
Hi, I have a similar configuration using both rcpt-to and virtual: you can take a look at it here https://l.changeme.fr.eu.org/email.html#opensmtpd-configuration The user listed in your /etc/smtpd/virtuals doesn’t have to be the owner of the socket, but needs to have permission to access the socket, as it is the user OpenSMTPD will use when connecting to the socket. (Whether a user has access to the socket can be set in your Dovecot configuration.) In this case I think you may want rcpt-to, otherwise OpenSMTPD will try to deliver to LMTP user vmail as well (unless your Dovecot account is actually named vmail). I hope this can help.
