Sooner or later, we have to deal with the postfix configurations running on IPFire web servers, for example (web01.ipfire.org, ...). In my eyes, we have the following issues here: - no TLS (it is an internal network, but we want that anyway) - mails are cached very long (~ 5 days, I consider 3 days [normal mail] and 1 day [bounces] to be sufficient) - nearly all mail is accepted (even those to non-existent domains, which just burn resources).
We currently use the DNS alias relay.i.ipfire.org. That domain should therefore be in the SSL certificate that Postfix currently uses. How do we deal with bounced emails from internal services like cron? They are usually going back to <user>@<hostname> and the relay is never able to deliver them.
Meanwhile, this has been fixed as all of our mail infrastructure is now using TLS 1.3 and DANE. :-)