not familiar at all with SRS

[f1-outsourcing]

Currently I have this sort of setup. Where external email is received on a mx server that relays to local mail server for users to collect their email.

               email

                 |
                 |
                 |
                 V
          +------------+
          |     MX     |
          |            |
          |  accessmap |
          |            |
          +------+-----+
                 |
                 |
                 |
          +------+-----+
          |    LOCAL   |
          |            |
          |  virtuser  |
          |            |
          +------------+

Ideally (I guess) I would like to have the MX servers check if the email needs local delivery or forwarded, and if it is externally forwarded, it should go through the srs milter on the mx servers to the external server. Do I understand this correctly? I was thinking of putting the forward address in the virtuser table.

[d--j]

An example:

• Your MTA is responsible for example.com (MX of example.com is your MTA).
• The address [email protected] actually is not a local mailbox but needs to be forwarded to [email protected].
• The user [email protected] sends an email to [email protected].

Without SRS:

• Gmail's SMTP server sends the email to your MTA
• Your MTA determins that it needs to be forwarded and re-sends the email to [email protected]
• Gmail's MX will reject the email – all it sees is some random MTA on the internet which wants to send an email impersonating [email protected]

With SRS:

• Gmail's SMTP server sends the email to your MTA
• Your MTA determins that it needs to be forwarded and re-writes the sender address from [email protected] to SRS0=HASH=TIME=gmail.com=[email protected]. Only send it re-sends the email to [email protected]
• Gmail's MX will accept this email since it now can validate that your MTA is responsible for example.com (e.g. with SPF).

In your setup: Which of the two MTAs (MX and local) actually knows which address is local and which needs to be forwarded? Normally that is only the local MTA. The MTA that knows that (and actually does the re-sending) needs SRS rewriting.
It is kinda hard for a milter to actually get the forwarding address. This srs-milter does it by looking up the source ([email protected]) in a MySQL lookup table to get the destination ([email protected]). When your setup also uses MySQL for the lookup table then you can use this milter.