Provider inbound MX

Coldfeet can terminate inbound SMTP itself (coldfeet_mx) or let an ESP (Amazon SES, Mailgun, SendGrid, Resend, Postmark, MailerSend) accept mail and replay it into the pipeline over an authenticated webhook (provider_mx).

Pure MX mode

Functionality only requires the domain’s MX change. Legitimate senders deliver to the ESP; Coldfeet filters/quarantines and relays clean mail to the final destination (Microsoft 365, Google Workspace, Exchange, etc.). Restricting the backend connector / firewall to gateway IPs is optional hardening — not a prerequisite.

Internet Sender
      │
      ▼
 MX Record  ──────────────►  ESP (SES / SendGrid / Mailgun / Resend / Postmark / MailerSend)
      │
      ▼
 Authenticated webhook  ──►  Coldfeet (scan + quarantine)
      │
      ▼
 Relay clean mail  ───────►  Final mailboxes

Why

Provider MX keeps Coldfeet’s IP off public DNS. The ESP absorbs abuse and connection load; Coldfeet still scans, applies policy, and delivers to the tenant’s smart host.

What you lose

Because the ESP has already accepted the message before Coldfeet sees it:

Greylisting
Connect-time DNSBL rejection (partially restoreable on SES via receipt filters)
Per-IP connection rate limiting
RCPT-time 550 for unknown recipients (SES recovers this via recipient-scoped rules)

Unknown recipients on SendGrid/Mailgun/Resend/Postmark/MailerSend are dropped and recorded in Rejections (source=webhook). We never generate a bounce to a forged sender (backscatter). On SES, mail for domains that have not been promoted is rejected at the SES edge with 550 because receipt-rule recipients are scoped to promoted FQDNs only.

Rspamd still scores RBL/reputation against the recovered origin IP from the Received: chain.

Hard precondition

provider_mx cannot be enabled without a configured delivery destination (relay host/port, or local mailbox hosting). Without that, scanned mail would MX-lookup the ESP and loop back into the webhook ingest.

Outbound ESP relay is also blocked when any recipient domain is hosted here with provider_mx, for the same reason.

Webhook ingest also refuses recipients whose domain is still in coldfeet_mx mode, even if the signature verifies.

Size limits

Platform ceiling is 35 MB (nginx client_max_body_size 40m, Nest parser scoped to /api/v1/public/inbound and /api/v1/public/relay-events). Larger messages are rejected with the provider’s stop-retry status.

MTA-STS cutover

MTA-STS and TLS-RPT are suppressed for provider-MX domains. A Coldfeet policy naming our mail host would cause enforcing senders to refuse delivery to the ESP.

If the domain already publishes _mta-sts naming Coldfeet:

Remove the _mta-sts TXT record
Wait out the policy max_age (default 7 days)
Then change MX to the ESP hosts shown in the onboarding wizard

Per-provider notes

Provider	MX	Outbound SMTP	Size	Auth	stopRetryStatus	Inbound automation
Mailgun	`mxa.mailgun.org` / `mxb.mailgun.org`	`smtp.mailgun.org` / `smtp.eu.mailgun.org`	35 MB	HMAC over `timestamp+token`	406	Routes created via API
SES	`inbound-smtp.<region>.amazonaws.com`	`email-smtp.<region>.amazonaws.com`	35 MB	SNS signature + topic ARN / bucket pin	200	S3 + SNS + receipt rule provisioned from IAM keys
SendGrid	`mx.sendgrid.net`	`smtp.sendgrid.net`	35 MB	ECDSA via security policy; `send_raw=true`	200	Inbound Parse + security policy via API
Resend	`inbound-smtp.<region>.amazonaws.com`	`smtp.resend.com` (user `resend`)	35 MB	Svix HMAC-SHA256 on `${id}.${timestamp}.${rawBody}`	406	`email.received` webhook + Receiving API fetch
Postmark	`inbound.postmarkapp.com`	`smtp.postmarkapp.com`	35 MB	URL token + Postmark webhook IP allowlist (no HMAC)	406	Server `InboundHookUrl` + `InboundDomain` via API
MailerSend	`inbound.mailersend.net`	`smtp.mailersend.net`	35 MB	HMAC-SHA256 `Signature` header over raw body	406	Inbound route webhook via API

Webhook endpoints:

Inbound: POST /api/v1/public/inbound/:provider
Bounce events: POST /api/v1/public/relay-events/:provider

Postmark inbound and bounce URLs include ?token=<high-entropy>; both token and source IP (Postmark webhook IPs below) must match.

PUBLIC_API_URL must be set (install sets it to WEB_URL/api). Coldfeet normalizes /api → /api/v1 when registering notify URLs so they match the reverse-proxy routes.

Resend

Receiving MX: inbound-smtp.<region>.amazonaws.com (priority 10). Regions: us-east-1, eu-west-1, sa-east-1, ap-northeast-1.
Outbound SMTP: smtp.resend.com:587, username resend, password = API key.
Webhook: Subscribe to email.received. Payload is metadata only.
Raw MIME: GET /emails/receiving/{email_id} → raw.download_url.
Signature: Svix headers svix-id, svix-timestamp, svix-signature (v1,<base64>). HMAC-SHA256 over ${id}.${timestamp}.${rawBody} with the webhook signing secret (whsec_…).
stopRetryStatus: 406 (permanent auth/size reject).

Postmark

Receiving MX: inbound.postmarkapp.com (priority 10).
Outbound SMTP: smtp.postmarkapp.com:587; username and password are both the server token.
Credentials: Account token (domain API) + server token (SMTP + server API), stored as JSON in apiKeyEnc.
Inbound auth: High-entropy URL query token (timing-safe compare) and client IP in Postmark webhook range. Postmark does not support HMAC webhook signatures.
Webhook IPs (2026-03): 3.134.147.250, 50.31.156.6, 50.31.156.77, 18.217.206.57 (source). Coldfeet caches and refreshes this list daily.
Raw MIME: Prefer RawEmail / raw-email field on the inbound JSON POST.
stopRetryStatus: 406.

MailerSend

Receiving MX: inbound.mailersend.net (priority 10).
Outbound SMTP: smtp.mailersend.net:587; per-domain SMTP users created via POST /v1/domains/{id}/smtp-users (Mailgun shape — no account-level fallback).
Domains: POST /v1/domains.
Inbound route: POST /v1/inbound with webhook forward; route returns an HMAC signing secret in forwards[].secret.
Signature: Signature header = HMAC-SHA256 hex of raw request body.
Raw MIME: data.raw on inbound.message webhook payload.
stopRetryStatus: 406.

SES automated setup

Relay accounts need only three credentials: AWS access key ID, secret access key, and region. Coldfeet:

Derives the SES SMTP username (access key ID) and password (AWS-documented HMAC)
Optionally mints a least-privilege IAM user under /coldfeet/ when the pasted key can iam:CreateUser
On Provision inbound, creates/reuses:
- S3 bucket with public-access block, 7-day lifecycle on inbound/ (transient spool — not the quarantine), and a bucket policy allowing ses.amazonaws.com s3:PutObject
- SNS topic + policy + HTTPS subscription to the notify URL (the topic ARN is recorded first, since ingest rejects notifications from any other topic — including the subscription confirmation)
- Receipt rule set + rule (TlsPolicy: Require, S3 + SNS actions)
On domain promote to provider_mx, adds the FQDN to the rule’s Recipients (spilling to a second rule past 100 recipients)
On demote/remove, removes the recipient

Required IAM actions are available from Admin → Workers → Relay accounts → AWS policy JSON (GET /api/v1/admin/egress/relay-accounts/aws/policy).

Sandbox is detected during preflight/test — production accounts are assumed. Quota (Max24HourSend / MaxSendRate) is stored and used to prefill caps and pace sends.

Admin flow

Admin → Workers → Relay accounts → Add relay account (full-page form)
Choose provider; for SES paste access key + secret + region and Verify
Optionally mint a least-privilege IAM user, then save
Enable inbound MX; for SES click Preview plan then Provision inbound
On the domain, configure a delivery destination first
Switch Inbound MX to Provider MX and select the account
Publish the wizard’s MX (and relay identity) records

Multi-account

Multiple relay accounts can coexist. Outbound selection is sticky per domain with priority failover and hourly/daily (plus provider-quota) headroom checks.