- Shipped
- September 16, 2026 at 5:16 PM UTC
- Author
- Kamo
- Commit
- e9c1a51
KamoCRM's own campaign mail keeps leaving through postfix-bulk (47.181.8.87) and regular mail through postfix (47.181.8.84). Every other organization's campaign mail gets its own IP: postfix-orgs runs on k3m1's host network and binds its outgoing SMTP to eno1 (k3m1-ext), which node-config/k3m1-ext routes out that port and nothing else uses. HELO is contact.kamocrm.com, the name Frontier is setting as the IP's PTR. A hostNetwork listener has no NetworkPolicy, so submission is SASL over required STARTTLS on port 587 of the node's internal address, from cluster addresses only (secrets in mail/SECRETS.md). It relays only as the sending domains EmailService has verified, refreshed every minute — until that map arrives, nothing. The same egress guard as postfix-bulk holds delivery until eno1 is confirmed to leave as .86, and the same delivery-events sidecar reports results. Every refusal is a 4xx, never a 5xx. Appended to the files the deploy workflow already applies, so the workflow (and a full reconcile of every component) is untouched.