ispcomm Wrote:1. I do not modify the domain template. I just use an fixed ip or a dyndns service for the customer relay.
I did this because otherwise the {mail,smtp,pop3,imap}.domain.tld entries would point to the primary MX (our mail cleaner) and not the user's server which has the real mailboxes. Without this change the user can't set up their mail client using those records...
ispcomm Wrote:2. Do not export recipient maps from the "Exchange" but rely on the verify daemon to verify valid recipients before accepting the inbound mail.
I must admit that I didn't take a look at it, because I had gone to the
postfix documentation solution directly. As your solution seemed cleaner I've taken a look at it, but on the
verify manpage you can read:
Quote:BUGS
The address verification service is suitable only for
sites that handle a low mail volume. Verification probes
add additional traffic to the mail queue and perform
poorly under high load. Servers may blacklist sites that
probe excessively, or that probe excessively for non-exis-
tent recipient addresses.
If the persistent database ever gets corrupted then the
world comes to an end and human intervention is needed.
This violates a basic Postfix principle.
As both reasons are show-stoppers for me I'll keep my current setup

Do you want me to write the how-to? It's basically an ispcp adapted version of the howto linked on the official postfix docs.