Postfix vs Haraka: Default Linux MTA vs Event-Driven Node.js Filtering Engine (2027)

// Intercept RCPT TO command and query internal Redis cluster
exports.hook_rcpt = async function (next, connection, params) {
    const recipient = params[0].address().toLowerCase();
    const redis = connection.server.notes.redis;

    try {
        // Query Redis in-memory cache for customer status
        const isBanned = await redis.get(`banned:${recipient}`);
        if (isBanned) {
            return next(DENY, "Recipient account suspended for abuse.");
        }

        // Query internal REST validation API asynchronously
        const response = await fetch(`https://api.internal/v1/verify?email=${encodeURIComponent(recipient)}`);
        const data = await response.json();

        if (data.deliverable) {
            return next(); // Accept recipient and proceed
        } else {
            return next(DENY, "Recipient address does not exist.");
        }
    } catch (err) {
        connection.logerror(`Validation failure: ${err.message}`);
        return next(); // Fail open on internal API downtime
    }
};
    

# Configure external milters for content inspection and DKIM
smtpd_milters = inet:127.0.0.1:11332, inet:127.0.0.1:8891
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

# Enforce recipient restrictions using static hash tables
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    check_recipient_access hash:/etc/postfix/access_recipients,
    reject_unverified_recipient
    

[Public Internet (Port 25)]
         │
         ▼
┌────────────────────────────────────────────────────────┐
│  Tier 1: Haraka Edge Shield (DMZ / Public IP)         │
│  - Asynchronous event loop holds 20k concurrent TCP    │
│  - DNSBL & Spamhaus IP blocking                        │
│  - Real-time Redis rate-limiting                       │
│  - In-band early talker & SPF validation               │
│  - Drops 80% of junk traffic at connection time        │
└────────────────────────────────────────────────────────┘
         │ (Clean, Validated Traffic via Internal Network)
         ▼
┌────────────────────────────────────────────────────────┐
│  Tier 2: Postfix Core Mail Server (Private Subnet)     │
│  - Local user mailbox delivery via Dovecot LMTP        │
│  - Reliable disk spool queue scheduling                │
│  - Inbound IMAP/POP3 authentication                    │
│  - Zero resource exhaustion from internet spam storms  │
└────────────────────────────────────────────────────────┘