Skip to content
MailDock Docs

Relaying & trusted networks

Purpose. Decide who may hand the server a message for a domain it does not host, and have it delivered onward. Relaying without authentication is how spam gets sent through other people’s servers, so almost nobody may: a person sends by signing in on port 587 or 465, and an internet server delivering to your domains needs no relay at all. The few hosts that genuinely need to relay without a password are listed here.

Who may relay without signing in. Three sources, and nothing else:

  • Loopback (127.0.0.0/8, ::1) — the mail container itself.
  • The stack’s own Docker network. The mail server sends Sieve redirects and out-of-office replies through Postfix on port 25 without signing in, from the Dovecot container. That network’s subnet is whatever Docker chose when the stack was created, so the Postfix and Rspamd containers read it from their own network interfaces each time they start and trust exactly that subnet. It is not configurable and needs no setting.
  • Trusted networks — Settings → Trusted networks in the admin console (trustedNetworks in the server configuration). One network per line in address/bits form, IPv4 or IPv6, empty by default. An entry that is not a valid network is refused when you save, and so is one too broad to trust: an IPv4 network shorter than /8, an IPv6 network shorter than /32, or an IPv6 network that holds more than a /8 of the IPv4-mapped space (::/64 holds all of it). Every address in a trusted network may send through the server without a password, so 0.0.0.0/0 would make it an open relay. A configuration saved before this rule keeps working; the next save asks for a narrower entry, and a rollback to a version holding one is refused (400 trusted_network_too_broad). Each entry is written into Postfix’s and Rspamd’s configuration in one canonical form with its host bits cleared (Settings → Trusted networks keeps what you typed), so 203.0.113.9/24 trusts 203.0.113.0/24, and IPv6 entries are bracketed for Postfix ([2001:db8::]/32). Put a host here when it should send through this server without a password, such as a printer, a monitoring box or an application server on your LAN.

Everything else must sign in. A client anywhere else that tries to send to a domain the server does not host is refused with 554 5.7.1 Relay access denied, whether its address is public or private. That includes other machines on the same private network — a cloud VPC, a LAN, or anything behind the same load balancer or NAT.

The same set decides what the spam filter treats as local. Rspamd skips greylisting and SPF and DKIM checks for local senders, does not add its verdict headers to their mail, and does not ARC-seal it. A host in Trusted networks gets that treatment too, so only add hosts you control.

Limits & edge cases.

  • Docker’s bridge gateway is inside the trusted subnet, because it is the network’s own address. A client that Docker’s userland proxy presents as the gateway would be trusted. The stack publishes on IPv4 with an explicit bind address so internet clients do not arrive that way, and mailctl doctor checks for it.
  • A host that used to relay because of its private address no longer does. Until 2026-09-24 every private range was trusted: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. A LAN device that relied on that now gets Relay access denied. Add it to Trusted networks.
  • After an upgrade, Postfix keeps the old wide list until the control plane re-renders, which it does at its first boot on the new version. The spam filter narrows as soon as its container starts, and until that re-render it does not see your Trusted networks either. That holds on the latest tag too: the control plane compares the build itself, not the tag it was pulled by.
  • Only the ban exemption still trusts the IPv6 gateway. Postfix excludes it with ![…], and Rspamd’s local_addrs and the Dovecot master’s allow_nets are written without it. STACK_INTERNAL_NETWORKS holds the whole IPv6 subnet, gateway included, so a client Docker’s proxy carries over IPv6 can never be banned by IP. That matters only if Docker carries IPv6 through its proxy, which mailctl doctor reports as ✖.
  • IPv6 is optional. With IPv6 off (the default), Postfix listens on IPv4 and an IPv6 entry here is accepted and rendered but no IPv6 client can reach the server. With it on, the Compose network’s own IPv6 subnet is trusted beside its IPv4 one, and the network’s gateway address is excluded from relay trust (IPv6).
  • Docker Desktop (development only) presents the host machine as 192.168.65.1, which is outside the stack’s subnet. Mail sent from the host to port 25 is therefore greylisted like internet mail. The smoke test takes SMOKE_TRUSTED_NETWORKS=192.168.65.0/24 for that case.