1# Forward messages to a remote MX23Default maddy configuration is done in a way that does not result in any4outbound messages being sent as a result of port 25 traffic.56In particular, this means that if you handle messages for example.org but not7example.com and have the following in your aliases file (e.g. /etc/maddy/aliases):89```10foxcpp@example.org: foxcpp@example.com11```1213You will get "User does not exist" error when attempting to send a message to14foxcpp@example.org because foxcpp@example.com does not exist on as a local15user.1617Some users may want to make it work, but it is important to understand the18consequences of such configuration:1920- Flooding your server will also flood the remote server.21- If your spam filtering is not good enough, you will send spam to the remote22 server.2324In both cases, you might harm the reputation of your server (e.g. get your IP25listed in a DNSBL).2627**So, this is a bad practice. Do so only if you clearly understand the28consequences (including the Bounce handling section below).**2930If you want to do it anyway, here is the part of the configuration that needs31tweaking:3233```34msgpipeline local_routing {35 destination postmaster $(local_domains) {36 modify {37 replace_rcpt regexp "(.+)\+(.+)@(.+)" "$1@$3"38 replace_rcpt file /etc/maddy/aliases39 }4041 deliver_to &local_mailboxes42 }4344 default_destination {45 reject 550 5.1.1 "User doesn't exist"46 }47}48```4950In default configuration, `local_routing` block is responsible for handling51messages that are received via SMTP or Submission and have the initial52destination address at a local domain.5354Note the `modify { }` block being nested inside `destination` and then followed55by unconditional `deliver_to &local_mailboxes`. This means: if address is56on `$(local_domains)`, apply aliases and deliver to mailboxes from57`&local_mailboxes`.5859The problem here is that recipients are matched before aliases are resolved so60in the end, maddy attempts to look up foxcpp@example.com locally. The solution61is to insert another step into the pipeline configuration to rerun matching62*after* aliases are resolved. This can be done using the 'reroute' directive:6364```65msgpipeline local_routing {66 destination postmaster $(local_domains) {67 modify {68 replace_rcpt file /etc/maddy/aliases69 ...70 }7172 reroute {73 destination postmaster $(local_domains) {74 deliver_to &local_mailboxes75 }76 default_destination {77 deliver_to &remote_queue78 }79 }80 }8182 default_destination {83 reject 550 5.1.1 "User doesn't exist"84 }85}86```8788## Bounce handling8990Once the message is delivered to `remote_queue`, it will follow the usual path91for outbound delivery, including queuing and multiple attempts. This also92means bounce messages will be generated on failures. When accepting messages93from arbitrary senders via the 25 port, the DSN recipient will be whatever94sender specifies in the MAIL FROM command. This is prone to [collateral spam]95when an automatically generated bounce message gets sent to a spoofed address.9697However, the default maddy configuration ensures that in this case, the NDN98will be delivered only if the original sender is a local user. Backscatter can99not happen if the sender spoofed a local address since such messages will not100be accepted in the first place.101102You can also configure maddy to send bounce messages to remote103addresses, but in this case, you should configure a really strict local policy104to make sure the sender address is not spoofed. There is no detailed105explanation of how to do this since this is a terrible idea in general.106107[collateral spam]: https://en.wikipedia.org/wiki/Backscatter_(e-mail)108109## Transparent forwarding110111As an alternative to silently dropping messages on remote delivery failures,112you might want to use transparent forwarding and reject the message without113accepting it first ("connection-stage rejection").114115To do so, simply do not use the queue, replace116```117deliver_to &remote_queue118```119with120```121deliver_to &outbound_delivery122```123(assuming outbound_delivery refers to target.remote block)