# PKI for TLS
pki mail.nastycode.com cert "/etc/ssl/mail.nastycode.com.crt" # path to SSL certificate
pki mail.nastycode.com key "/etc/ssl/private/mail.nastycode.com.key" # path to private key

# tables setup
table aliases file:/etc/mail/aliases
table domains file:/etc/mail/domains
table passwd file:/etc/mail/passwd
table users file:/etc/mail/users
table vusers file:/etc/mail/vusers
table hosts file:/etc/mail/hosts
table spammers file:/etc/mail/spammers

# Blocks junk mail
filter check_rdns phase connect match !rdns junk
filter check_fcrdns phase connect match !fcrdns junk
filter "dkimsign" proc-exec "filter-dkimsign -d nastycode.com -s mail -k /etc/mail/dkim/private.key" user _smtpd group _smtpd
#filter check_spammers phase connect match src <spammers> junk

# macros
ipv4 = "198.251.81.119"
ipv6 = "2605:6400:10:5bf::"
check = "pki mail.nastycode.com mask-src filter { check_rdns check_fcrdns } hostname nastycode.com"
authcheck = "pki mail.nastycode.com auth <passwd> mask-src senders <users> filter { check_rdns check_fcrdns dkimsign } hostname nastycode.com"

# listeners
listen on socket filter "dkimsign"
listen on lo0 filter "dkimsign"
listen on $ipv4 port 25 tls $check
listen on $ipv6 port 25 tls $check
listen on $ipv4 port 465 tls-require $authcheck
listen on $ipv6 port 465 tls-require $authcheck
listen on $ipv4 port 587 tls-require $authcheck
listen on $ipv6 port 587 tls-require $authcheck

# rules
action "lmtp" lmtp "/var/dovecot/lmtp" rcpt-to virtual <vusers>
action "relay" relay src $ipv4

match from any for domain <domains> action "lmtp"
match from src <hosts> for any action "relay"
match auth from any for any action "relay" 
