From 02d14796ccd9dd8d62ac8014caca50f0088c166a Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Sat, 20 Jun 2026 20:10:47 +0000 Subject: [PATCH] feat(mailserver): add trips@ send-as alias for TripIt native auth email (ADR-0028) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TripIt's native signup-verification + account-recovery mail (ADR-0028) sends From: trips@viktorbarzin.me while authenticating SMTP as spam@. With SPOOF_PROTECTION on, Postfix smtpd_sender_login_maps requires an EXPLICIT alias (the @domain catch-all doesn't satisfy it) — mirrors the existing plans@->spam@ grant. Must be applied + verified before TripIt flips SMTP_FROM to trips@, else every verification/recovery send is rejected 550. Co-Authored-By: Claude Opus 4.8 --- stacks/mailserver/modules/mailserver/extra/aliases.txt | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/stacks/mailserver/modules/mailserver/extra/aliases.txt b/stacks/mailserver/modules/mailserver/extra/aliases.txt index 61df501c..284c7061 100644 --- a/stacks/mailserver/modules/mailserver/extra/aliases.txt +++ b/stacks/mailserver/modules/mailserver/extra/aliases.txt @@ -10,3 +10,12 @@ vaultwarden@viktorbarzin.me me@viktorbarzin.me # catch-all does NOT, so an explicit entry is required). Also keeps inbound # plans@ routing to spam@ for the tripit mail-ingest poller. plans@viktorbarzin.me spam@viktorbarzin.me + +# trips@ -> spam@: same send-as grant for tripit's NATIVE auth email (ADR-0028 — +# signup-verification + account-recovery mail). tripit authenticates SMTP as +# spam@ and sends From: trips@viktorbarzin.me; SPOOF_PROTECTION's +# smtpd_sender_login_maps union exact-matches this alias to spam@ (the @domain +# catch-all does NOT). MUST be applied + verified BEFORE tripit flips SMTP_FROM +# to trips@, or every verification/recovery send is rejected (550 sender). Also +# routes any inbound trips@ to spam@. +trips@viktorbarzin.me spam@viktorbarzin.me