Docker Network as Postfix "mynetworks"

[67cwr3ej]

Support guidelines

• I've read the support guidelines

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem

Description

Postfix started rejecting emails from certain provider like Gmail with the following error:

Anonymous TLS connection established from unknown[172.19.0.1]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384
NOQUEUE: reject: RCPT from unknown[172.19.0.1]: 450 4.7.1 Client host rejected: cannot find your reverse hostname

I noticed that the IP address is the one Docker gave my container. Apparently the Docker network is not regarded as mynetwork when using the bridge mode (default).

I cannot exactly say since which update the problem occurs but it was working perfectly until at least 9th of May.

The solution is to set POSTFIX_MYNETWORKS="127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 172.19.0.0/24" in the container environment. The first part is the default. Please make sure you are using the right IP range. My Docker compose network looks like this now (not set before):

networks:
  external:
    driver: bridge
    ipam:
      config:
        - subnet: 172.19.0.0/24
          gateway: 172.19.0.1

Expected behaviour

No emails are getting rejected coming from my own Docker network.

Actual behaviour

Emails are getting rejected when coming from my Docker network for certain providers.

Steps to reproduce

1. Run addy with a bridge network
2. Receive a mail from Gmail
3. Check the logs for the rejection

Docker info

Client: Docker Engine - Community
 Version:    29.4.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.33.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.1.3
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Docker Compose config

Logs

Anonymous TLS connection established from unknown[172.19.0.1]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384
NOQUEUE: reject: RCPT from unknown[172.19.0.1]: 450 4.7.1 Client host rejected: cannot find your reverse hostname

Additional info

No response