Chart version 4.2.3 generates fatal postscreen/proxywrite error and fails to accept non-authenticated connections

[rich0]

When upgrading from chart version 4.2.2 to 4.2.4, after restarting the docker-mailserver pod I began getting this error when there were unauthenticated SMTP connections. Authenticated connections appeared to be working.

2025-09-19T12:23:50.495191+00:00 docker-mailserver-58b49658b7-cd4tc postfix/proxymap[19102]: warning: request for unapproved table: "btree:/var/lib/postfix/postscreen_12525_cache"
2025-09-19T12:23:50.495197+00:00 docker-mailserver-58b49658b7-cd4tc postfix/proxymap[19102]: warning: to approve this table for read-write access, list proxy:btree:/var/lib/postfix/postscreen_12525_cache in main.cf:proxy_write_maps
2025-09-19T12:23:50.495232+00:00 docker-mailserver-58b49658b7-cd4tc postfix/smtpd-proxyprotocol/postscreen[19792]: fatal: proxywrite service is not configured for table "btree:/var/lib/postfix/postscreen_12525_cache"

Reverting to 4.2.2 fixed the issue. I haven't had time to do more digging through the source changes/etc. I also haven't confirmed if the issue is with 4.2.3 or 4.2.4 yet and intend to do so...

[cfis]

Hmm, that doesn't ring any bells. Maybe something in docker mailserver itself? If you can track it down to 4.2.3 or 4.2.4 that would be great. Thanks!

[rich0]

Ok, I confirmed that the issue is with 4.2.3. I'm pretty sure it isn't docker-mailserver as the image hasn't changed between these versions (mailserver/docker-mailserver:15.0.2).

I noticed this change in master.cf between the two versions:
4.2.2:

# Smtp with proxy
12525     inet  n       -       n       -       1       postscreen
  -o syslog_name=postfix/smtpd-proxy
  -o postscreen_upstream_proxy_protocol=haproxy
  -o postscreen_cache_map=btree:/postscreen_10025_cache

4.2.3

12525      inet  n       -       n       -       1       postscreen
    -o postscreen_upstream_proxy_protocol=haproxy
    -o postscreen_cache_map=proxy:btree:$data_directory/postscreen_12525_cache
    -o syslog_name=postfix/smtpd-proxyprotocol

Note the change to postscreen_cache_map

-o postscreen_cache_map=btree:/postscreen_10025_cache
-o postscreen_cache_map=proxy:btree:$data_directory/postscreen_12525_cache

I'm not familiar with postscreen so I'll need to do some digging. The value in 4.2.2 seems like a possible typo (10025), but I'm not sure what impact the addition of the proxy directive has.

[rich0]

It appears the issue is that a change was made to make use of proxymap, but it wasn't configured to provide access to this file. (Which is basically want the warning states.) I'm not familiar with proxymap or why it is being implemented here. I don't have time to test it right at this moment, but removing the proxy directive probably would fix this. Alternatively, so might giving write access to the proxy service.

This is also being enabled in conjunction with proxy support in values.yaml, which might be a result of confusion? The proxymap feature of postfix isn't really related to support for having a network proxy - at least not as far as I can tell. In any case I need to look into this further to understand what is going on, or what the intended feature is here.

[polarathene]

UPDATE: See the next comment for a better approach.

---

The feature was added to support ProxyProtocol when required (such as using a reverse proxy / load balancer that needs to preserve the original client IP as it forwards the traffic to the DMS container). A recent PR related to that for the chart with this service at port 12525 is here: #174

DMS only officially documents this config, as no contribution of a feature to the DMS scripts has been done yet, while this chart applies the community documented advice based on user feedback and some basic testing.

warning: to approve this table for read-write access, list proxy:btree:/var/lib/postfix/postscreen_12525_cache in main.cf:proxy_write_maps

So all this is saying is that we need to add an extra line to the DMS Postfix config override the chart is using with postfix-main.cf (EDIT: user-patches.sh) to then also add proxy_write_maps line which can then reference our new proxied service.

Checking the default assignment we have already:

$ postconf proxy_write_maps
proxy_write_maps = $smtp_sasl_auth_cache_name $lmtp_sasl_auth_cache_name $address_verify_map $postscreen_cache_map

# Use `-d` to see the default value from Postfix if unset (which is the case in DMS):
$ postconf -d proxy_write_maps
proxy_write_maps = $smtp_sasl_auth_cache_name $lmtp_sasl_auth_cache_name $address_verify_map $postscreen_cache_map

# Use `-x` to expand the `$` variables referenced:
$ postconf -x proxy_write_maps
proxy_write_maps = btree:/var/lib/postfix/verify_cache btree:/var/lib/postfix/postscreen_cache

So we will probably want to preserve that list and append our own to it. As the feature is done with user-patches.sh we can take the default value and add the new one like so:

postconf "proxy_write_maps = $(postconf -d proxy_write_maps) proxy:btree:\$data_directory/postscreen_12525_cache"

[polarathene]

Actually... it seems that the chart was missing an extra addition from our docs guidance, and I don't think there's any reason to be specifying a separate postscreen cache.

I'm not familiar with proxymap or why it is being implemented here.

The proxy: / proxymap config was actually intended to share the same cache with the non-ProxyProtocol postscreen service (running on port 25), which would avoid logging an error like this when both ports receive mail and otherwise attempt to share the same cache:

postfix/smtpd-proxyprotocol/postscreen[1163]: fatal: btree:/var/lib/postfix/postscreen_cache: unable to get exclusive lock: Resource temporarily unavailable

So a solution for you would either be:

• Avoid the proxy: prefix, using separate cache DBs for the two postscreen services running (now no longer requires the previous proxy_write_maps fix)
• Alternatively configure the main.cf setting instead of overriding via master.cf config, and both postscreen services will inherit that shared cache where proxy: prefix will avoid the lock issues.

Doing the latter option will also sort out this proxy_write_maps issue, since as shown earlier it's already configured to use the postscreen_cache_map setting, thus no updates required 👍

---

All we need to do is remove the addition from the final user-patches.sh command, and follow-up with this instead:

postconf 'postscreen_cache_map = proxy:btree:$$data_directory/postscreen_cache'

This will share the cache though, which may not have much benefit since one postscreen is handling traffic from the public traffic and another is for internal/private traffic direct to DMS.

---

Here's a reproduction compose.yaml for Docker Compose to use:

name: example

# Specifying a subnet to assign a fixed container IP to the reverse proxy:
networks:
  default:
    name: my-network
    ipam:
      config:
        - subnet: "172.16.13.0/24"

services:
  reverse-proxy:
    image: docker.io/traefik:3.5
    # CAUTION: In production you should configure the Docker API endpoint securely:
    # https://doc.traefik.io/traefik/providers/docker/#docker-api-access
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command:
      # Docker provider config:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      # Public inbound ports to proxy to DMS ports:
      - --entryPoints.mail-smtp.address=:25
    # An IP is assigned here for other services (Dovecot) to trust for PROXY protocol:
    networks:
      default:
        ipv4_address: 172.16.13.2
        aliases:
          - mail.example.test

  dms:
    image: ghcr.io/docker-mailserver/docker-mailserver:${DMS_RELEASE:-15.1.0}
    # NOTE: Using `OVERRIDE_HOSTNAME` here instead so that connections relying on Docker Compose embedded DNS will
    # resolve the DMS FQDN to the reverse proxy service which will then route traffic to DMS with ProxyProtocol
    #hostname: mail.example.test
    # These are all set for reproduction purposes only, no relevance to the feature itself:
    environment:
      OVERRIDE_HOSTNAME: mail.example.test
      ENABLE_AMAVIS: 0
      ENABLE_UPDATE_CHECK: 0
    # Here Traefik is configured to proxy `mail-smtp` (port 25) to the DMS container port 12525 (ProxyProtocol enabled):
    labels:
      - traefik.enable=true
      # These are examples, configure the equivalent for any additional ports you proxy.
      # Explicit TLS (STARTTLS):
      - traefik.tcp.routers.mail-smtp.rule=HostSNI(`*`)
      - traefik.tcp.routers.mail-smtp.entrypoints=mail-smtp
      - traefik.tcp.routers.mail-smtp.service=mail-smtp
      - traefik.tcp.services.mail-smtp.loadbalancer.server.port=12525
      - traefik.tcp.services.mail-smtp.loadbalancer.proxyProtocol.version=2
    # Instead of `volumes` to provide these config files, I'm using the Docker Compose `configs` feature
    # so it's all embedded into the single `compose.yaml`:
    configs:
      - source: dms-accounts
        target: /tmp/docker-mailserver/postfix-accounts.cf
      - source: support-proxyprotocol
        target: /tmp/docker-mailserver/user-patches.sh

  # This will be used to test mail as if from a third-party:
  mail-client:
    scale: 0 # Avoids starting this container during `docker compose up`
    image: ghcr.io/docker-mailserver/docker-mailserver:${DMS_RELEASE:-15.1.0}
    # This will be implicitly inferred as the HELO FQDN presented by `swaks` when connecting to DMS:
    # (Alternatively, add the `--helo` option to the `swaks` command)
    hostname: mail.remote.test
    networks:
      default:
        #ipv4_address: 172.16.13.37 # ✅ rDNS: `PTR mail.remote.test.`
        # Mail to port 25 / 12525 will perform a security check to verify the sender domain exists,
        # so we add an alias here for it to also resolve to the same container acting as a mail client:
        # (NOTE: Using authenticated submission ports 587/465 would bypass this restriction check)
        aliases:
          - remote.test
    # This default command sends a test mail to DMS at port 25 (or 12525 when Traefik is used), just like any other third-party client:
    # NOTE: `>-` will fold the multi-line value into a single-line value which is valid for invoking a command.
    command: >-
      swaks --server mail.example.test --port 25
        --from jane.doe@remote.test
        --to john.doe@example.test
        --silent

# The Docker Compose `configs` feature inlines file content into `compose.yaml`
# NOTE: `$` will be inferred as an ENV on the host to replace with a value if found,
#       `$$` is required as an escape to opt-out of that feature when an actual `$` is expected in the file content.
configs:
  dms-accounts:
    content: |
      john.doe@example.test|{SHA512-CRYPT}$$6$$sbgFRCmQ.KWS5ryb$$EsWrlYosiadgdUOxCBHY0DQ3qFbeudDhNMqHs6jZt.8gmxUwiLVy738knqkHD4zj4amkb296HFqQ3yDq4UXt8.

  # NOTE: This is only configuring support for Postfix, not Dovecot:
  support-proxyprotocol:
    content: |
      #!/bin/bash

      # NOTE: Keep in sync with upstream advice:
      # https://github.com/docker-mailserver/docker-mailserver/blob/v15.0.0/docs/content/examples/tutorials/mailserver-behind-proxy.md?plain=1#L238-L268

      # Duplicate the config for the submission(s) service ports (587 / 465) with adjustments for the PROXY ports (10587 / 10465) and `syslog_name` setting:
      postconf -Mf submission/inet | sed -e s/^submission/10587/ -e 's/submission/submission-proxyprotocol/' >> /etc/postfix/master.cf
      postconf -Mf submissions/inet | sed -e s/^submissions/10465/ -e 's/submissions/submissions-proxyprotocol/' >> /etc/postfix/master.cf
      # Enable PROXY Protocol support for these new service variants:
      postconf -P 10587/inet/smtpd_upstream_proxy_protocol=haproxy
      postconf -P 10465/inet/smtpd_upstream_proxy_protocol=haproxy

      # Create a variant for port 25 too (NOTE: Port 10025 is already assigned in DMS to Amavis):
      postconf -Mf smtp/inet | sed -e s/^smtp/12525/ >> /etc/postfix/master.cf
      # Enable PROXY Protocol support (different setting as port 25 is handled via postscreen), optionally configure a `syslog_name` to distinguish in logs:
      postconf -P \
        12525/inet/postscreen_upstream_proxy_protocol=haproxy \
        12525/inet/syslog_name=postfix/smtpd-proxyprotocol

      # Use `proxy:` prefix to share this cache between each running postscreen service:
      postconf 'postscreen_cache_map = proxy:btree:$$data_directory/postscreen_cache'

Then you can verify with the following commands:

# Start up DMS and Traefik:
docker compose up -d --force-recreate

# Send mail through Traefik's port 25 to DMS port 12525:
docker compose run --rm -it --use-aliases mail-client

# Send mail through DMS directly at it's port 25
# (port 12525 will fail since swaks is not adding a ProxyProtocol header which isn't necessary for a direct connection)
docker compose run --rm -it --use-aliases mail-client swaks --server dms --port 25 \
  --from jane.doe@remote.test \
  --to john.doe@example.test \
  --silent

# Neither warning is logged:
docker compose logs dms | grep exclusive
docker compose logs dms | grep 'unapproved table'

[polarathene]

PR raised at #187

[rich0]

Ah, using proxymap makes sense in that case. I just don't personally need it as all of my traffic goes through the ingress. In any case the fix will be helpful!