Seeking Guidance: Replacing NGINX Mail Proxy with Postfix for Outbound Email Controls in GCP

[Pilu1978]

Hi everyone,

I’m looking for some advice around Postfix and whether it can help solve an issue we’re currently facing with outbound email control in Google Cloud Platform (GCP).

---

Our application teams run various workloads on GCP, and whenever these applications need to send email, the traffic is relayed through an NGINX mail proxy hosted in the same environment.

1. Application → Load Balancer → NGINX Mail Proxy → IronPort/Backend Mail Server

• The load balancer provides availability and failover.
• The NGINX mail proxy simply relays SMTP traffic to an internal backend mail server.

Our backend mail server enforces a limit of 2000 emails per hour. Recently, a rogue application sent 6000+ emails within minutes, causing the backend server to block all mail flow for an hour.

---

We want to enforce tighter outbound controls before traffic reaches the backend—specifically:

• 100 emails per hour per IP/application
• Additional controls that NGINX cannot provide

This triggered an exploration into whether Postfix can replace NGINX as our mail relay and provide the required security and throttling.

---

Can the following be achieved with Postfix acting as a relay?

We’re looking for confirmation from anyone experienced with similar setups.

• Protection against email spamming / sender‑based blocking
• Rate limiting per sender / per IP
• Restricting or validating allowed sender domains
• Whitelisting permitted senders
• Message throttling (per-app or per-IP limits)
• No message queueing (or at least minimal queueing)
• Malware / content scanning integration
• Detailed logging and visibility

From early research, tools like postfwd, OpenDKIM, SPF/DMARC checking, and milter services seem promising, but I’d appreciate real-world confirmation.

---

Below is the conceptual design I came up with. It feels a bit complex, so I would appreciate feedback if I’m over‑engineering or missing something.

• Apps generate raw SMTP traffic

• Centralized DKIM signing
• Rate limiting (postfwd)
• Enforce allowed sender domain list
• Per-IP and per-sender throttling

• Validate SPF, DKIM, DMARC
• Anti‑spoofing controls
• Additional rate limiting
• Relays mail to backend using TLS

• Trusted internal system
• Receives only authenticated, validated, and rate‑limited traffic

---

Since my experience with Postfix is limited, I’d really appreciate help with the following:

• Is Postfix the right tool for this?
• Are all the above controls achievable in a single Postfix relay layer?
• Is the proposed design overly complex, or is this the standard way to achieve secure outbound relay controls?
• Any configuration examples, best practices, or gotchas would be extremely helpful.

Thanks in advance to anyone who can share insight, recommendations, or validation of this approach!

 

[Richard G]

I’m looking for some advice around Postfix and whether it can help solve an issue we’re currently facing with outbound email control in Google Cloud Platform (GCP).

Sorry, you're one the wrong forums.

This is a support forum for Directadmin license holders only for use with the Directadmin hosting panel, we don't do normal pc or server support.
And Directadmin only uses Exim and no Postfix.

You can best head over to a forum like webhostingtalk.com, serverfault.com, linuxquestions.org or similar sites.