mail: relay outbound mail through Amazon SES

Gmail and other large providers refuse mail sent directly from our residential IP. Send outbound mail through an SES SMTP relay configured from the vault (mail_relay_host, mail_relay_user, mail_relay_password). Unset values fall back to direct delivery. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-07 15:36:15 -05:00
1 changed files with 8 additions and 0 deletions
@@ -222,6 +222,14 @@
                    value: "(&(objectClass=posixAccount)(mailGroupMember=%s))"
                  - name: LDAP_QUERY_FILTER_SENDERS
                    value: "(&(objectClass=posixAccount)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))"
+                  # Outbound relay (Amazon SES): residential IPs are refused by Gmail et al.
+                  # Leave mail_relay_host unset to deliver directly.
+                  - name: DEFAULT_RELAY_HOST
+                    value: "{{ mail_relay_host | default('') }}"
+                  - name: RELAY_USER
+                    value: "{{ mail_relay_user | default('') }}"
+                  - name: RELAY_PASSWORD
+                    value: "{{ mail_relay_password | default('') }}"
                  - name: SPOOF_PROTECTION
                    value: "1"
                  - name: DOVECOT_AUTH_BIND