Managing multiple Postfix instances on a single host

Question

We have quite a few sites on our Xserve. Each site should be able to relay email out the respective unique IP on a single host; however, by default email goes out the default website of the server or which IP is the current gateway.
NOTE: this is not a Postfix Virtual Domain Hosting > mail forwarding domains issue. Mail routes just fine to the correct email boxes. This is and issue where email going out to other mail servers originates from the box and not the respective domains and IP space.
The solution for this is Multiple PostFix Instances. One for each website (each website has a respective IP due to SSL and DNS is correct along with MX records).
For the outbound mail relay for our corporate network it seems there are no fields to enable a new postfix instance for each hosted or virtually hosted domain. Nor is there a way to enable SMTP to relay outgoing mail through another host unless you use a generic setting for every website on the server.
So for a enterprise level business how do we Managing multiple Postfix instances on a single host?

Answer 1

Fully on the same page with you. 110%
Here is why I am under the impression of why each domain name needs to be as if it needs its own MTA (mail transfer agent). No matter how big or small the business.
Just like a domain using SSL in Apache needs a dedicated IP when doing the packets . . .
Yahoo the big dog (for small to medium online businesses 70% of their customers make purchases with Yahoo emails; which most of them are temp emails or known as aliases.) states:
From: help.yahoo.com/l/us/yahoo/mail/postmaster/basics/postmaster-02.html
Many mail providers follow the same guidelines:
{quote}Segregate your lists to different IP addresses. If you maintain several lists (or clients, especially for an ASP), you may want to segregate your lists to ensure that users are marking each list on its own merits. If user sees both spam and legitimate mail from the same IP, their notifications to us will be hazy and will likely result in the spam overiding the legitimate mail.{quote}
So why not segregate websites to email out their own dedicated IPs?
Understandably sites that share IP space can go out the default MTA or better yet the MTA of that IP.
This way host providers can segment groups of clients and further prevent issues with out going email.
When email goes out a single MTA there are checks and rate limitations not just on the hops involved but from the "originating" IP address. So if site "A" has one IP and site "B" has another . . . well they both send email out the same default gateway. Take 100's of domains going out the same IP and customers (websites) start having issues getting customer communications delivered.
{quote}Maintain accurate reverse-DNS information for your mail servers. Yahoo! Mail makes extensive DNS checks for each connection, and an accurate reverse DNS will ensure prompt processing of your connection and email.{quote}
One mistake by one client out of 1,000 sites (or now Apple letting tens of thousands of sites able to be hosted) can get all 1,000 websites deferred and have what is called "reputation" issues.
In the past, as companies grow, sure they get more boxes or can cluster mail servers. With economic times beyond using Parallels . . . a single Mac Xserve can handle tens of thousands of websites doing a few thousand emails a day or more. It is more of a software/setting/configuration issue than just capability.
I remember Intel board meetings in the 90's where I (as a customer) stated put two nic cards on the mother board, standardize those rails, put twisted pair on those hard drive cables. Some things just take practical experience to see yes there is a real need and the business people are not getting it because they are focussing on the business or chasing their tail.
Also Note the IP address has to be STATIC:
From: help.yahoo.com/l/us/yahoo/mail/postmaster/errors/550-bl21.html;ylt=AsNxnjlX971dwy743e7j.olJHdG
{quote}In our continuing efforts to protect our users from unsolicited email, Yahoo! Mail does not accept SMTP connections from dynamic or residential IP addresses . . .{quote}
From: help.yahoo.com/l/us/yahoo/mail/postmaster/basics/postmaster-15.html
{quote}Segregate your mail streams by IP addresses, domains and/or DKIM selectors since Yahoo! Mail keeps reputation data about each IP address and domain you send from. For example, by segmenting the mail stream that delivers marketing mail from another that sends transactional messages, you make it easier for Yahoo! Mail to determine and assign each mail stream's reputation. {quote}
{quote} Use common-sense settings. While we have not published guidelines for numbers of connections you can concurrently use, we ask that you treat our resources with respect. The more you take, the fewer there are for others, which may force us to defer your connections. {quote}
From: help.yahoo.com/l/us/yahoo/mail/postmaster//basics/postmaster-38.html
{quote}To facilitate the smooth flow of messages between legitimate senders and Yahoo! Mail, we offer the following recommendations:
Limit the messages you send per connection
Yahoo! Mail accepts a maximum of 5 messages per SMTP connection. We encourage you to cap the number of messages you send to Yahoo! Mail to fall within this per-connection limit.
When this limit is reached, no further messages will be accepted for delivery as our server automatically terminates the connection (without giving an error code). If you are sending messages to a significant number of Yahoo! Mail users, the suggestions below will help ensure uninterrupted delivery for your messages.
Reestablish connections if you do not get an error code
When our server terminates your connection after 5 messages have been accepted, you may try to reconnect to our MX servers immediately thereafter.
Open concurrent connections
You may open concurrent connections from the same server to facilitate efficient transmission of your messages. However, while we do not publish specific guidelines for the numbers of connections you can concurrently use, we ask that you treat our resources with respect. The more you take, the fewer there are for others, which may force us to deprioritize connections from your server(s).{quote}
In the Server Admin under General one can enable IMAP with a maximum number of connections. However, for normal SMTP there is no connections cap. Unless I am wrong here.
Domain throttling by domain is another way, but the real solution is just dedicated IPs for each website or each website to have a separate MTA. In the past this has meant a dedicated server or a physical gateway.
Technically there should be a Virtual solution. If I can virtually host many sites and many incoming emails on dedicated IP space respective to each domain. There should be virtual MTAs on dedicated or the same respective IP space as the incoming; hence, why I gave the example of how SSL works in Apache with web servers.
Totally get what you are saying on how currently mail works just out the default gateway since there is only one "default" MTA for the "xserve".
Everything is good coming in, but did something somewhere miss the mark on the outgoing? Should be one for one.
Yahoo is the big player putting the foot down or the glass half full people would say setting the mark on how outgoing mail should work when they are accepting emails.
I am not trying to innovate, but rather just follow the rules.
Sure mail out one MTA works no matter how many website you put on the box and it is "good enough for government work" or "looks good from my house".
There are many people struggling with corporate communications (even the concept of corporate communications and marketing) and I think Apple could step up to the plate and help follow the standard of best practices.
I have done research for 10 years and over the past two tested what I know to be true. Then spoke with many businesses that did not understand but had the same issue. . .
Yahoo customers not getting their email communications and email simply not being as good as the old fashion phone call.
So back to your question (fabulous question since every tech asks me the same thing):
{quote}So my question to you is this: why can't you run all your domains on a single server/IP address?{quote}
Because it is no longer 1996 and I want Apple stock to triple!
. . . and that it no longer works for sites conducting a profitable business. We are really underachieving what America could do!
Yahoo! is clearly saying to each business to do business communications or even marketing on separate IPs. Gmail, Hotmail, and the list goes on and on. They all follow the same thing. Yahoo! just happens to be more aggressive and has more good consumers (buyers) using their free email service. Gmail started aliases and could gain market share of buyers.
I need to get Xserve to have one dedicated IP in and out for each independent website whether it is an Apache transaction on port 80 (443 SSL) or an email going out the postfix MTA on port 25 SMTP or any other standard alternative port (587 or 465 SSL) for that matter.
So far everything works as expected, but the SMTP MTA out. One big default gateway per hardware.
We missed the 1% mark. That club that gets it! I would like to see every business owner that buys an Xserve to be in that one percent club out of the box!
Why Rob? Well because it works! Dedicated IPs work. Think about this, if you gave the postman your address and did not include your suite number more than likely your lucky if you get your mail. WORKS the same way for email.
If your business grows you can get a few more until something once again gets abused and they start tracking MAC addresses. By then will have virtual MAC addresses like most routers can already do.
To prevent SPAM you just set the MTA defaults to one IP per website. Let's keep it simple. This way you keep a clean reputation and one reputation per website or business. Most businesses just need one IP and cannot afford a whole server for each website/business. THINK GREEN!!! The email filtering systems (RBLs and filtering rules) already out there will weed abusers out. Let's not hurt the small to medium businesses in the process.
Your not going to get RDNS and dedicated IP space anyhow unless your a real business.