From 507b2225b174437b7f6a0827c93b1a99a793c6fe Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 7 Nov 2026 15:36:15 -0500 Subject: [PATCH] mail: relay outbound mail through Amazon SES Gmail and other large providers refuse mail sent directly from our residential IP. Send outbound mail through an SES SMTP relay configured from the vault (mail_relay_host, mail_relay_user, mail_relay_password). Unset values fall back to direct delivery. Co-Authored-By: Claude Opus 5.5 --- tasks/mail.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tasks/mail.yaml b/tasks/mail.yaml index a3df119..7465fec 100644 --- a/tasks/mail.yaml +++ b/tasks/mail.yaml @@ -222,6 +222,14 @@ value: "(&(objectClass=posixAccount)(mailGroupMember=%s))" - name: LDAP_QUERY_FILTER_SENDERS value: "(&(objectClass=posixAccount)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))" + # Outbound relay (Amazon SES): residential IPs are refused by Gmail et al. + # Leave mail_relay_host unset to deliver directly. + - name: DEFAULT_RELAY_HOST + value: "{{ mail_relay_host | default('') }}" + - name: RELAY_USER + value: "{{ mail_relay_user | default('') }}" + - name: RELAY_PASSWORD + value: "{{ mail_relay_password | default('') }}" - name: SPOOF_PROTECTION value: "1" - name: DOVECOT_AUTH_BIND