MX gateway and relay server integration for Mailcow environments

Pitbull integration with Mailcow

In environments using Mailcow, Pitbull integration works on two channels:

• Inbound: DNS MX records point to the Pitbull gateway; Rspamd-based filtering, quarantine and policy engine secure inbound traffic.
• Outbound: Outbound traffic is routed through Pitbull relay via Mailcow Postfix relayhost settings.

Relay Server Configuration

Set relayhost = [relay.pitbull.com.tr]:587 in Mailcow UI > Configuration > Options > Routing or in data/conf/postfix/extra.cf. Add smtp_sasl_password_maps for SMTP AUTH.

Inbound MX Gateway

• Point domain MX records to the Pitbull gateway address (priority 10)
• Rspamd spam, phishing and malware filtering at the gateway layer
• Malicious attachment scanning via ClamAV / Avast REST
• SPF, DKIM and DMARC checks + score breakdown
• Suspicious messages isolated in quarantine; admin-approved release workflow

Outbound Relay Settings

To route outbound traffic to the Pitbull relay on Mailcow:

# data/conf/postfix/extra.cf
relayhost = [relay.pitbull.com.tr]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = texthash:/opt/postfix/conf/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt

# sasl_passwd
[relay.pitbull.com.tr]:587 tenant@pitbull.com.tr:RELAY_TOKEN

docker compose restart postfix-mailcow

This configuration passes outbound traffic through the Pitbull outbound filtering engine. SMTP Abuse Radar, per-tenant rate limits and Emergency Outbound Lockdown are activated.

Authentication

• Add Pitbull include to SPF
• Enable DKIM signing from Pitbull panel and publish DNS TXT record
• Start DMARC at p=none and monitor reports

Operational Visibility

Monitor delivery rates, reject reasons, queue status and GeoIP/ASN distribution on NOC screens. Deliver periodic security summaries to management teams with executive PDF reports.