Can't figure out LDAP mailing list

[tailtwo]

Hello,

I am trying to set up mailing lists with a LDAP server, but I can't figure out how it is supposed to work. I have the following filters (pulled from the official documentation) :

name = "(&(|(objectClass=posixAccount)(objectClass=posixGroup))(uid=?))"
email = "(&(|(objectClass=posixAccount)(objectClass=posixGroup))(|(mail=?)(mailAlias=?)(mailList=?)))"
verify = "(&(|(objectClass=posixAccount)(objectClass=posixGroup))(|(mail=*?*)(mailAlias=*?*)))"
expand = "(&(|(objectClass=posixAccount)(objectClass=posixGroup))(mailList=?))"
domains = "(&(|(objectClass=posixAccount)(objectClass=posixGroup))(|(mail=*@?)(mailAlias=*@?)))"

I then add a mailList attribute containing the address of the mailing list to a posixGroup object with existing users. Then when sending a mail to this mailing list address, I get a Enhanced code: 5.1.2, Message: Relay not allowed. from the mail server.

What am I missing?

[mdecimus]

Hi,

You are seeing that error because the domains search is not returning any results for the address you are trying to email. Use a tool such as ldapsearch to verify that all your LDAP filters yield results.

[markv9401]

Is Stalwart supposed to be able to actually resolve LDAP mailing lists? I have a CN (group) that has a mailList attribute which it clearly reads properly, as it does accept and deliver mails to - into the "group's mailbox" (if that even makes sense - shouldn't...) instead of resolving the group members and delivering the mail to each of them.
I mean the members do have access to the shared "mailbox" of the group, but that's just not how it's supposed to work afaik

[mdecimus]

In LDAP you need to add the mailing list address to the mailAlias attribute of each account that is a member of the list.

[markv9401]

Isn't that just an alias then, as the name (mailAlias) states too? (Also, wouldn't it make it impossible to have multiple aliases? Or list is accepted as the return value?)
Is it possible to have a group (like cn=usersOfSomething,dc=somedomain,dc=com) that has an attribute (say mail, mailList or anything else) and then if that address in this specific attribute is the RCPT TO then the group memberships get evaulated .members and their mail gets substituted into RCPT TO

Maybe it's easier if I show you an example doing exactly this, Postfix config style:

server_host = ldaps://ldap.domain.com
version = 3
bind = yes
start_tls = no
bind_dn = uid=postmaster,ou=people,dc=domain,dc=com
bind_pw = xxxxxxxxxxxxxxxxx
search_base = ou=groups,dc=domain,dc=com
scope = sub
query_filter = (cn=%s)
special_result_attribute = member
leaf_result_attribute = uid

In this case if [email protected] is the RCPT TO and something is a valid cn=something,ou=groups,dc=domain,dc=com then instead of creating a "pseudo-mailbox" for something, its members gets searched and the members' uid are the return values, making them the RCPT TO

[mdecimus]

Isn't that just an alias then, as the name (mailAlias) states too? (Also, wouldn't it make it impossible to have multiple aliases? Or list is accepted as the return value?)

Yes, currently in LDAP mailing lists are configured as account email aliases.

Is it possible to have a group (like cn=usersOfSomething,dc=somedomain,dc=com) that has an attribute (say mail, mailList or anything else) and then if that address in this specific attribute is the RCPT TO then the group memberships get evaulated .members and their mail gets substituted into RCPT TO

Not currently, if you create the mailing list as a group, messages will be sent to the account and not to the account members.