diff --git a/docs/deliverability.md b/docs/deliverability.md index 993b66c..d17c4fc 100644 --- a/docs/deliverability.md +++ b/docs/deliverability.md @@ -87,9 +87,19 @@ any UI/test send that doesn't set From explicitly. | **Trucking** (listmonk) | **207.174.124.94** | mta05.performancewest.net | listmonk -> :25 -> `randmap:{out05:}` | | **Healthcare** (listmonk-hc) | **207.174.124.107** | hcmta01.performancewest.net | listmonk-hc SMTP server 1 -> :2526 -> hcout1 | | Transactional / verification | 207.174.124.71 + co.carrierone.com (.15) | perfwest | default `smtp_bind_address` (.71) + :587 relay (.15) | -| Yahoo/AOL trickle | 207.174.124.90 | mta01 | `yahooslow` transport (hash:transport) | -| Retired (torched May 30-31) | .91 / .92 / .93 | mta02-04 | rehab02-04 — **`pw-ip-rehab` cron DISABLED 2026-06-19** | -| Dormant (re-expand later) | .95-.105, .108-.109 | mta06-17, hcmta02-03 | disabled | +| Removed 2026-06-23 (snowshoe cleanup) | .90-.93, .95-.106, .108-.109 | mta01-04/06-17, hcmta02-03 | transports + host IP bindings DELETED | + +**Snowshoe IP cleanup (2026-06-23):** the 18 dormant sending IPs (.90-.93, +.95-.106, .108-.109) were fully removed from BOTH postfix (`master.cf` +transports `yahooslow`/`out02-04`/`out06-20`/`rehab02-04`/`2527`/`2528`/ +`hcout2`/`hcout3`) AND the host (`/etc/network/interfaces` + live `ip addr del`). +Only the two warm sending IPs (.94 trucking, .107 HC) plus infra (.71/.72) +remain bound. A 20-IP footprint reads as snowshoe spam and was hurting domain +reputation; the SPF was already trimmed to .94/.107 on 2026-06-19, so this just +makes the host/postfix match the SPF intent. Verified live: `postfix check` OK, +both streams still `status=sent` post-change, SSH unaffected. Reference snapshots +committed at `infra/postfix/live-snapshots/master.cf` + `infra/network/interfaces` +(live backups `/root/master.cf.bak_snowshoe_*` + `/root/interfaces.bak_snowshoe_*`). **Root SPF (trimmed 2026-06-19):** `v=spf1 a mx ip4:207.174.124.15 ip4:207.174.124.94 ip4:207.174.124.107 -all` — `a`=.71, `mx`=co.carrierone.com(.15), diff --git a/infra/network/interfaces b/infra/network/interfaces new file mode 100644 index 0000000..1449938 --- /dev/null +++ b/infra/network/interfaces @@ -0,0 +1,28 @@ +# This file describes the network interfaces available on your system +# and how to activate them. For more information, see interfaces(5). + +source /etc/network/interfaces.d/* + +# The loopback network interface +auto lo +iface lo inet loopback + +# The primary network interface +allow-hotplug ens18 +iface ens18 inet static + address 207.174.124.71/23 + address 207.174.124.72/23 + # Mail sending IPs (consolidated 2026-06-23 to remove snowshoe footprint): + # .94 = mta05 -> trucking stream (out05) + # .107 = hcmta01 -> healthcare HOT stream (hcout1) + # The dormant rotation pool (.90-.93, .95-.106, .108-.109 / mta01-20, + # hcmta02-03) was removed: a 20-IP footprint reads as snowshoe spam and + # hurt domain reputation. To re-expand later, re-add the address lines + # here + the postfix transports (master.cf) + BOTH SPF records, SLOWLY + # (one IP at a time, days apart, only after Postmaster Tools shows green). + address 207.174.124.94/23 + address 207.174.124.107/23 + gateway 207.174.124.1 + # dns-* options are implemented by the resolvconf package, if installed + dns-nameservers 8.8.8.8 8.8.4.4 + dns-search performancewest.net diff --git a/infra/postfix/live-snapshots/master.cf b/infra/postfix/live-snapshots/master.cf new file mode 100644 index 0000000..58ed369 --- /dev/null +++ b/infra/postfix/live-snapshots/master.cf @@ -0,0 +1,194 @@ +# +# Postfix master process configuration file. For details on the format +# of the file, see the master(5) manual page (command: "man 5 master" or +# on-line: https://www.postfix.org/master.5.html). +# +# Do not forget to execute "postfix reload" after editing this file. +# +# ========================================================================== +# service type private unpriv chroot wakeup maxproc command + args +# (yes) (yes) (no) (never) (100) +# ========================================================================== +smtp inet n - y - - smtpd +#smtp inet n - y - 1 postscreen +#smtpd pass - - y - - smtpd +#dnsblog unix - - y - 0 dnsblog +#tlsproxy unix - - y - 0 tlsproxy +# Choose one: enable submission for loopback clients only, or for any client. +#127.0.0.1:submission inet n - y - - smtpd +#submission inet n - y - - smtpd +# -o syslog_name=postfix/submission +# -o smtpd_forbid_unauth_pipelining=no +# -o smtpd_tls_security_level=encrypt +# -o smtpd_sasl_auth_enable=yes +# -o smtpd_tls_auth_only=yes +# -o local_header_rewrite_clients=static:all +# -o smtpd_hide_client_session=yes +# -o smtpd_reject_unlisted_recipient=no +# Instead of specifying complex smtpd__restrictions here, +# specify "smtpd__restrictions=$mua__restrictions" +# here, and specify mua__restrictions in main.cf (where +# "" is "client", "helo", "sender", "relay", or "recipient"). +# -o smtpd_client_restrictions= +# -o smtpd_helo_restrictions= +# -o smtpd_sender_restrictions= +# -o smtpd_relay_restrictions= +# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject +# -o milter_macro_daemon_name=ORIGINATING +# Choose one: enable submissions for loopback clients only, or for any client. +#127.0.0.1:submissions inet n - y - - smtpd +#submissions inet n - y - - smtpd +# -o syslog_name=postfix/submissions +# -o smtpd_forbid_unauth_pipelining=no +# -o smtpd_tls_wrappermode=yes +# -o smtpd_sasl_auth_enable=yes +# -o local_header_rewrite_clients=static:all +# -o smtpd_hide_client_session=yes +# -o smtpd_reject_unlisted_recipient=no +# Instead of specifying complex smtpd__restrictions here, +# specify "smtpd__restrictions=$mua__restrictions" +# here, and specify mua__restrictions in main.cf (where +# "" is "client", "helo", "sender", "relay", or "recipient"). +# -o smtpd_client_restrictions= +# -o smtpd_helo_restrictions= +# -o smtpd_sender_restrictions= +# -o smtpd_relay_restrictions= +# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject +# -o milter_macro_daemon_name=ORIGINATING +#628 inet n - y - - qmqpd +pickup unix n - y 60 1 pickup +cleanup unix n - y - 0 cleanup +qmgr unix n - n 300 1 qmgr +#qmgr unix n - n 300 1 oqmgr +tlsmgr unix - - y 1000? 1 tlsmgr +rewrite unix - - y - - trivial-rewrite +bounce unix - - y - 0 bounce +defer unix - - y - 0 bounce +trace unix - - y - 0 bounce +verify unix - - y - 1 verify +flush unix n - y 1000? 0 flush +proxymap unix - - n - - proxymap +proxywrite unix - - n - 1 proxymap +smtp unix - - y - - smtp +relay unix - - y - - smtp + -o syslog_name=${multi_instance_name?{$multi_instance_name}:{postfix}}/$service_name +# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 +showq unix n - y - - showq +error unix - - y - - error +retry unix - - y - - error +discard unix - - y - - discard +local unix - n n - - local +virtual unix - n n - - virtual +lmtp unix - - y - - lmtp +anvil unix - - y - 1 anvil +scache unix - - y - 1 scache +postlog unix-dgram n - n - 1 postlogd +# +# ==================================================================== +# Interfaces to non-Postfix software. Be sure to examine the manual +# pages of the non-Postfix software to find out what options it wants. +# +# Many of the following services use the Postfix pipe(8) delivery +# agent. See the pipe(8) man page for information about ${recipient} +# and other message envelope options. +# ==================================================================== +# +# maildrop. See the Postfix MAILDROP_README file for details. +# Also specify in main.cf: maildrop_destination_recipient_limit=1 +# +#maildrop unix - n n - - pipe +# flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient} +# +# ==================================================================== +# +# Recent Cyrus versions can use the existing "lmtp" master.cf entry. +# +# Specify in cyrus.conf: +# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4 +# +# Specify in main.cf one or more of the following: +# mailbox_transport = lmtp:inet:localhost +# virtual_transport = lmtp:inet:localhost +# +# ==================================================================== +# +# Cyrus 2.1.5 (Amos Gouaux) +# Also specify in main.cf: cyrus_destination_recipient_limit=1 +# +#cyrus unix - n n - - pipe +# flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user} +# +# ==================================================================== +# +# Old example of delivery via Cyrus. +# +#old-cyrus unix - n n - - pipe +# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user} +# +# ==================================================================== +# +# See the Postfix UUCP_README file for configuration details. +# +#uucp unix - n n - - pipe +# flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) +# +# ==================================================================== +# +# Other external delivery methods. +# +#ifmail unix - n n - - pipe +# flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) +# +#bsmtp unix - n n - - pipe +# flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -f $sender $nexthop $recipient +# +#scalemail-backend unix - n n - 2 pipe +# flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store +# ${nexthop} ${user} ${extension} +# +#mailman unix - n n - - pipe +# flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py +# ${nexthop} ${user} + +# Slow transport for Gmail/Microsoft/Yahoo (strict rate limiting during warmup) +slow unix - - n - 2 smtp + -o smtp_destination_rate_delay=5s + -o smtp_destination_concurrency_limit=2 + +# Pipe bounce notifications to Listmonk +listmonk-bounce unix - n n - - pipe + flags=FDq user=nobody argv=/usr/local/bin/listmonk-bounce-handler.sh + +# === Trucking sending transport (consolidated to ONE warm IP) === +# out05 = .94 / mta05. The multi-IP snowshoe rotation was removed +# 2026-06-23 (snowshoe footprint hurt domain reputation). To re-expand +# later, re-add transports here + host IPs + SPF, SLOWLY. +out05 unix - - n - - smtp + -o smtp_bind_address=207.174.124.94 + -o smtp_helo_name=mta05.performancewest.net + -o syslog_name=postfix/out05 + -o smtp_destination_concurrency_limit=2 + -o smtp_destination_rate_delay=2s + -o smtp_destination_recipient_limit=2 + +# === Healthcare HOT stream === +# Consolidated to ONE warm IP 2026-06-23: port 2526 -> hcout1 (.107). +# Ports 2527/2528 + hcout2/hcout3 (.108/.109) removed (snowshoe). The +# content_filter forces 2526 onto hcout1, overriding the global trucking +# transport_maps so hc mail never uses the trucking IP. +2526 inet n - y - - smtpd + -o syslog_name=postfix/hcsubmit107 + -o smtpd_client_restrictions=permit_mynetworks,reject + -o smtpd_recipient_restrictions=permit_mynetworks,reject_unauth_destination + -o smtpd_helo_required=no + -o content_filter=hcout1: +hcout1 unix - - y - - smtp + -o smtp_bind_address=207.174.124.107 + -o smtp_helo_name=hcmta01.performancewest.net + -o syslog_name=postfix/hcout1 + -o smtp_destination_concurrency_limit=10 + -o smtp_destination_rate_delay=0s + -o smtp_destination_recipient_limit=20 + +sinktest unix - - n - - smtp + -o smtp_send_xforward_command=no