LMTP: advertise DSN so MTAs send ORCPT (it is already honoured)
Hello,
When moving from dovecot-lda (deliver -a ${original_recipient}) to LMTP, the original envelope recipient is lost, even though Dovecot's LMTP already supports it.
Setup
- Dovecot 2.4.1-4 (Debian 13, 1:2.4.1+dfsg1-6+deb13u7), Pigeonhole sieve.
- Postfix delivering with virtual_transport = lmtp:unix:private/dovecot-lmtp.
- Aliases such as postmaster@example.com are expanded by Postfix to a real mailbox (user@example.com) before delivery.
What happens
- Dovecot's LHLO reply advertises 8BITMIME, CHUNKING, ENHANCEDSTATUSCODES, PIPELINING, STARTTLS, but not DSN.
- Postfix only sends the ORCPT parameter (RFC 3461) to servers that advertise DSN, so it sends RCPT TO:<user@example.com> with no ORCPT.
- Sieve's envelope "to" therefore sees only the final address. A rule that worked under dovecot-lda with -a stops matching: if envelope :localpart :is "to" "postmaster" { ... }
But ORCPT is honoured when sent. Talking to the LMTP socket by hand: LHLO test MAIL FROM:<user@example.com> RCPT TO:<user@example.com> ORCPT=rfc822;postmaster@example.com DATA ... The message is accepted, and the sieve rule above matches, so the original recipient reaches sieve. The same message without ORCPT does not match.
Request. Could LMTP advertise DSN in its LHLO reply, either always or behind a setting? Since ORCPT is already parsed and used, this looks like a small change, and MTAs would then pass the original recipient. That would make LMTP equivalent to deliver -a for sieve envelope tests, and presumably for lmtp_hdr_delivery_address = original.
If there's an existing way to get this that I've missed, I'd be glad to hear it.
Thanks, Dhaval Patel
Op 9-10-2026 om 22:29 schreef Dhaval Patel via dovecot:
If there's an existing way to get this that I've missed, I'd be glad to hear it.
https://doc.dovecot.org/2.4.5/core/summaries/settings.html#lda_original_reci...:
lda_original_recipient_header
The header from which the original recipient address (used in the SMTP RCPT TO: address) is obtained if that address is not available elsewhere.
With LDA the default is based on the username in -d parameter. With LMTP Server the default is the same as RCPT TO.
Example:
lda_original_recipient_header = X-Original-To
https://www.postfix.org/postconf.5.html:
enable_original_recipient (default: yes)
Enable support for the original recipient address after an address is rewritten to a different address (for example with aliasing or with canonical mapping).
The original recipient address is used as follows:
Final delivery With "enable_original_recipient = yes", the original recipient address is stored in the X-Original-To message header. This header may be used to distinguish between different recipients that share the same mailbox.
Thanks. I tried that route, but Postfix only writes X-Original-To in its own final-delivery agents (local, virtual, pipe); the lmtp client doesn't add it. Of 18 messages delivered over LMTP in the last day, 17 have no X-Original-To, and the one that does carries lists-debian-security-announce@bendel.debian.org, inserted by Debian's list server upstream.
That second point is why I'd rather not rely on the header fallback: it reads whatever X-Original-To the message arrives with, so the "original recipient" can be set by a remote server or by the sender. ORCPT comes from the delivering MTA in the envelope and doesn't have that problem.
So the request stands: could LMTP advertise DSN (optionally behind a setting) so MTAs send ORCPT?
On (Tue) Oct 20, 2026 11:00 am, Stephan Bosch via dovecot <dovecot@dovecot.org> wrote:
Op 9-10-2026 om 22:29 schreef Dhaval Patel via dovecot:
If there's an existing way to get this that I've missed, I'd be glad to hear it.
https://doc.dovecot.org/2.4.5/core/summaries/settings.html#lda_original_reci...:
lda_original_recipient_header
The header from which the original recipient address (used in the SMTP RCPT TO: address) is obtained if that address is not available elsewhere.
With LDA the default is based on the username in -d parameter. With LMTP Server the default is the same as RCPT TO.
Example:
lda_original_recipient_header = X-Original-To
https://www.postfix.org/postconf.5.html:
enable_original_recipient (default: yes)
Enable support for the original recipient address after an address is rewritten to a different address (for example with aliasing or with canonical mapping).
The original recipient address is used as follows:
Final delivery With "enable_original_recipient = yes", the original recipient address is stored in the X-Original-To message header. This header may be used to distinguish between different recipients that share the same mailbox.
dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org
- Dhaval Patel via dovecot <dovecot@dovecot.org>:
Thanks. I tried that route, but Postfix only writes X-Original-To in its own final-delivery agents (local, virtual, pipe); the lmtp client doesn't add it. Of 18 messages delivered over LMTP in the last day, 17 have no X-Original-To, and the one that does carries lists-debian-security-announce@bendel.debian.org, inserted by Debian's list server upstream.
By default, the Postfix SMTP+LMTP client delivers mail to multiple recipients per delivery request. This is undesirable when prepending a Delivered-to: or X-Original-To: message header. To prevent Postfix from sending multiple recipients per delivery request, specify transport_destination_recipient_limit = 1 in the Postfix main.cf file, where transport is the name in the first column of the Postfix master.cf entry for this mail delivery service.
(most likely "lmtp"...)
-- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netz | Netzwerk-Administration Invalidenstraße 120/121 | D-10115 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt@charite.de | https://www.charite.de
Thanks for the suggestion about transport_destination_recipient_limit = 1. I agree this is the right setting when you want Postfix to add X-Original-To in a reliable way.
However, in my setup I am trying to avoid using X-Original-To and similar headers. These headers can be added or changed by remote systems before the message reaches my Postfix. In contrast, ORCPT is part of the local delivery envelope and is set by the final MTA.
My goal is for Dovecot’s LMTP server to always receive ORCPT, so that sieve’s envelope "to" can see the original recipient (as it did before with deliver -a).
At the moment:
Dovecot’s LMTP already accepts and uses ORCPT when it is present.
Postfix only sends ORCPT if the server advertises DSN.
Dovecot’s LMTP does not advertise DSN in its LHLO reply.
This is why I am asking whether LMTP could (optionally) advertise DSN. If it did, Postfix would send ORCPT, and Dovecot/sieve could use the original envelope recipient without depending on X-Original-To.
Thanks,
Dhaval
On (Wed) Oct 21, 2026 5:36 am, Ralf Hildebrandt via dovecot <dovecot@dovecot.org> wrote:
- Dhaval Patel via dovecot <dovecot@dovecot.org>:
Thanks. I tried that route, but Postfix only writes X-Original-To in its own final-delivery agents (local, virtual, pipe); the lmtp client doesn't add it. Of 18 messages delivered over LMTP in the last day, 17 have no X-Original-To, and the one that does carries lists-debian-security-announce@bendel.debian.org, inserted by Debian's list server upstream.
By default, the Postfix SMTP+LMTP client delivers mail to multiple recipients per delivery request. This is undesirable when prepending a Delivered-to: or X-Original-To: message header. To prevent Postfix from sending multiple recipients per delivery request, specify transport_destination_recipient_limit = 1 in the Postfix main.cf file, where transport is the name in the first column of the Postfix master.cf entry for this mail delivery service.
(most likely "lmtp"...)
-- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netz | Netzwerk-Administration Invalidenstraße 120/121 | D-10115 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt@charite.de | https://www.charite.de
dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org
Thanks for the suggestion about (->)transport_destination_recipient_limit = 1. I agree this is the right setting when you want Postfix to add
(->)X-Original-To in a reliable way.
However, in my setup I am trying to avoid using (->)X-Original-To and
similar headers. These headers can be added or changed by remote systems
before the message reaches my Postfix. In contrast, ORCPT is part of the
local delivery envelope and is set by the final MTA.
My goal is for Dovecot's LMTP server to always receive ORCPT, so that
sieve's (->)envelope "to" can see the original recipient (as it did
before with (->)deliver -a).
At the moment:
Dovecot's LMTP already accepts and uses ORCPT when it is present.
Postfix only sends ORCPT if the server advertises DSN.
Dovecot's LMTP does not advertise DSN in its LHLO reply.
This is why I am asking whether LMTP could (optionally) advertise DSN. If
it did, Postfix would send ORCPT, and Dovecot/sieve could use the original
envelope recipient without depending on (->)X-Original-To.
Thanks,
Dhaval
On (Wed) Oct 21, 2026 5:36 am, Ralf Hildebrandt via dovecot <dovecot@dovecot.org> wrote: >* Dhaval Patel via dovecot <dovecot@dovecot.org>: >> Thanks. I tried that route, but Postfix only writes X-Original-To in its own final-delivery agents (local, virtual, pipe); the lmtp client doesn't add it. Of 18 messages delivered over LMTP in the last day, 17 have no X-Original-To, and the one that does carries lists-debian-security-announce@bendel.debian.org, inserted by Debian's list server upstream. > >By default, the Postfix SMTP+LMTP client delivers mail to multiple >recipients per delivery request. This is undesirable when prepending a >Delivered-to: or X-Original-To: message header. To prevent Postfix >from sending multiple recipients per delivery request, specify > >transport_destination_recipient_limit = 1 > >in the Postfix main.cf file, where transport is the name in the first >column of the Postfix master.cf entry for this mail delivery service. > >(most likely "lmtp"...) > >-- >Ralf Hildebrandt > Geschaeftsbereich IT | Abteilung Netz | Netzwerk-Administration > Invalidenstrasse 120/121 | D-10115 Berlin > Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 > ralf.hildebrandt@charite.de | https://www.charite.de >
_______________________________________________ >dovecot mailing list -- dovecot@dovecot.org >To unsubscribe send an email to dovecot-leave@dovecot.org
participants (3)
-
Dhaval Patel
-
Ralf Hildebrandt
-
Stephan Bosch