# ==============================================================================
# INBOUND MX LISTENER & ZERO-TRUST SECURITY CONTROLS
# ==============================================================================
# Bind inbound listener to public interface port 25
smtp-listener 198.51.100.10:25

# Global Inbound Policy: Disallow relaying by default from all external hosts
<source 0/0>
    always-allow-relaying no
    smtp-service yes
    require-starttls no
    max-message-size 10M
    smtp-greeting-strict-syntax yes
</source>

# Authorize Internal Application Servers to Relay Outbound Mail
<source 10.0.0.0/8>
    always-allow-relaying yes
    smtp-service yes
    log-connections yes
</source>

# 1. Dedicated Return-Path Subdomain for Bounces (e.g., bounce.yourdomain.com)
<domain bounce.yourdomain.com>
    type pipe
    command "/usr/local/bin/python3 /opt/autosmtp/bin/parse_bounce.py"
    max-smtp-out 0
</domain>

# 2. Feedback Loop Ingestion Domain (e.g., fbl.yourdomain.com)
<domain fbl.yourdomain.com>
    type pipe
    command "/usr/local/bin/python3 /opt/autosmtp/bin/parse_fbl.py"
</domain>

# 3. Legitimate Replies Forwarded to Corporate Mailboxes (Google Workspace / M365)
<domain reply.yourdomain.com>
    type relay
    route aspmx.l.google.com
</domain>

#!/usr/bin/env python3
import sys
import email
from email import policy
import json
import urllib.request

# Read raw MIME email streamed via stdin from PowerMTA
raw_data = sys.stdin.buffer.read()
msg = email.message_from_bytes(raw_data, policy=policy.default)

recipient = msg.get('To', '')
sender = msg.get('From', '')
subject = msg.get('Subject', '')

# Parse diagnostic status code if DSN delivery failure
status_code = "5.0.0"
if msg.is_multipart():
    for part in msg.walk():
        if part.get_content_type() == 'message/delivery-status':
            for line in part.get_payload():
                if 'Status:' in str(line):
                    status_code = str(line).split('Status:')[1].strip()

# Instant suppression webhook to internal CRM / database
payload = json.dumps({"recipient": recipient, "code": status_code, "subject": subject}).encode('utf-8')
req = urllib.request.Request("http://127.0.0.1:8095/api/suppress.php", data=payload, headers={"Content-Type": "application/json"})
urllib.request.urlopen(req, timeout=3)
sys.exit(0)