Re: Two-way TLS and other security for LMTP over the internet?

an option to consider is

postfix @ vpn -> smtp relay transport, with TLS protections -> 2nd-postfix instance, on same server as dovecot

and,

2nd-postfix instance -> 'local' lmtp over unix socket -> dovecot listener

the postfix -> postfix secure config is rich & flexible, easily configured whether over open 'net, or over a vpn tunnel

yes, additional server instance to manage -- but that 2nd postfix config can be quite lightweight, and secured for only the postfix -> postfix -> dovecot config

ymmw