# Dovecot SMTP submission proxy configuration (dovecot 2.4 syntax)
#
# Terminates SSL/TLS for the local hostname (e.g. smtp.example.com) and
# proxies every login, credentials included, to the destination server
# (e.g. smtp.example.net) over its own SSL/TLS. After the login succeeds,
# dovecot forwards the connection bit-by-bit in both directions.

dovecot_config_version = 2.4.0
dovecot_storage_version = 2.4.0

protocols = submission
log_path = /dev/stdout

ssl = yes
ssl_server_cert_file = /etc/dovecot/ssl/cert.pem
ssl_server_key_file = /etc/dovecot/ssl/key.pem
ssl_min_protocol = TLSv1.2
ssl_client_ca_file = /etc/ssl/certs/ca-certificates.crt

auth_mechanisms = plain login

service submission-login {
  inet_listener submission {
    port = 587
  }
  inet_listener submissions {
    port = 465
    ssl = yes
  }
}

# Destination submission server. "ssl = yes" + port 465 = implicit TLS;
# for a STARTTLS destination use port 587 with "starttls = yes" instead
# of the ssl field.
passdb static {
  fields {
    nopassword = yes
    proxy = yes
    host = smtp.example.net
    port = 465
    ssl = yes
  }
}