...
smtp_tls_security_level = encrypt
smtp_sasl_tls_security_options = noanonymous
smtp_sasl_auth_enable = yes
relayhost = [post2.local]:submission
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd

...

/etc/postfix/sasl_passwd   
[post2.local]:submission sendingaccount@domain1.com:PASSWORD123

apt-get install postfix dovecot-core dovecot-pop3d dovecot-sieve dovecot-imapd postfix-pcre postgrey wget ca-certificates -y

groupadd -g 5000 vmail
useradd -s /usr/sbin/nologin -u 5000 -g 5000 vmail
usermod -aG vmail postfix
usermod -aG vmail dovecot

touch /var/log/dovecot.log
chown vmail:vmail /var/log/dovecot.log
chmod 660 /var/log/dovecot.log

touch /etc/dovecot/users
touch /etc/postfix/alias && postmap /etc/postfix/alias

cd /etc/ssl
openssl req -new -newkey rsa:3072 -nodes -keyout mailserver.key -days 9999 -x509 -out mailserver.crt

cd /etc/postfix
umask 022
openssl dhparam -out dh2048.tmp 2048 && mv dh2048.tmp dh2048.pem
chmod 644 dh2048.pem

smtpd_banner = $myhostname ESMTP Who are you gonna pretend to be today? 
biff = no
append_dot_mydomain = no
recipient_delimiter = +
readme_directory = no
myhostname = mail.yourdomain.com
mydomain = mail.yourdomain.com
myorigin = $mydomain
inet_interfaces = all
mydestination = localhost, $mydomain
mynetworks = 127.0.0.0/8


virtual_mailbox_base = /mail
virtual_alias_maps = hash:/etc/postfix/alias
virtual_minimum_uid = 100
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
mailbox_size_limit = 0

#SASL#



smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $mydomain
broken_sasl_auth_clients = yes


# Disable SSLv3
#
smtpd_tls_protocols = !SSLv2 !SSLv3
smtp_tls_protocols = !SSLv2 !SSLv3
lmtp_tls_protocols = !SSLv2 !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
lmtp_tls_mandatory_protocols = !SSLv2 !SSLv3

#TLS#

smtpd_use_tls=yes
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_cert_file=/etc/ssl/mailserver.crt
smtpd_tls_key_file=/etc/ssl/mailserver.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_received_header = yes
tls_random_source = dev:/dev/urandom
smtpd_tls_security_level = may
smtp_tls_security_level = may


# Fix 'The Logjam Attack'.
#
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem


smtpd_helo_required=yes
strict_rfc821_envelopes = yes
disable_vrfy_command = yes
smtpd_delay_reject = yes


anvil_rate_time_unit = 60s
smtpd_client_connection_rate_limit = 5
smtpd_client_connection_count_limit = 5

smtpd_error_sleep_time = 5s
smtpd_soft_error_limit = 2
smtpd_hard_error_limit = 3

smtpd_helo_restrictions= 
  permit_sasl_authenticated,
  reject_non_fqdn_hostname,
  reject_unknown_helo_hostname,
  reject_invalid_helo_hostname,


smtpd_client_restrictions = 
  permit_mynetworks,
  permit_sasl_authenticated,
  reject_unknown_client_hostname,
  reject_unauth_pipelining


smtpd_sender_restrictions = 
  permit_sasl_authenticated,
  reject_non_fqdn_sender,
  reject_unknown_sender_domain

smtpd_recipient_restrictions = 
  permit_mynetworks,
  permit_sasl_authenticated,
  reject_invalid_hostname,
  reject_non_fqdn_hostname,
  reject_non_fqdn_sender,
  reject_non_fqdn_recipient,
  reject_unauth_destination,
  reject_unauth_pipelining
 
smtpd_recipient_limit = 250
alias_maps = hash:/etc/aliases


#обслуживаемые домены
relay_domains = domain1.ru, domain2.ru

#карта транспорта
transport_maps = hash:/etc/postfix/transport_maps


#спраморезка
smtpd_milters = inet:127.0.01:11332
milter_default_action = tempfail
non_smtpd_milters =  inet:127.0.01:11332
milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}

domain1.ru	smtp:[192.168.1.101]:25
domain2.ru	smtp:[192.168.1.102]:25

postmap /etc/postfix/transport_maps

smtp      inet  n       -       -       -       -       smtpd
smtps     inet  n       -       -       -       -       smtpd
submission inet n       -       n       -       -       smtpd
pickup    fifo  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       -       -       -       smtp
relay     unix  -       -       -       -       -       smtp
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache
dovecot unix    -       n       n       -       -      pipe
    flags=DRh user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${domain} -m ${extension}

auth_mechanisms = plain login
disable_plaintext_auth = no
log_path = /var/log/dovecot.log
mail_location = maildir:/mail/%d/%n
mail_home = /mail/%d/%n
passdb {
  args = /etc/dovecot/users
  driver = passwd-file
}
userdb {
  args = /etc/dovecot/users
  driver = passwd-file                                               
  default_fields = uid=vmail gid=vmail userdb_home=/mail/%Ld/%Ln userdb_location=maildir:/mail/%Ld/%Ln
}         
protocols = imap pop3
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = vmail
    mode = 0660
    user = postfix
  }
  unix_listener auth-master {
    group = vmail
    mode = 0600
    user = vmail
  }
}
ssl_cert = </etc/ssl/mailserver.crt
ssl_key = </etc/ssl/mailserver.key

#Disable SSLv3
ssl_protocols = !SSLv2 !SSLv3


protocol lda {
  auth_socket_path = /var/run/dovecot/auth-master
  hostname = mail.yourdomain.com
  mail_plugin_dir = /usr/lib/dovecot/modules
  mail_plugins = sieve
  postmaster_address = postmaster@yourdomain.com
}

plugin {
  sieve = /mail/%Ld/%n/active.sieve
  sieve_dir = /mail/%Ld/%n/sieve
  sieve_max_script_size = 1M
  sieve_quota_max_scripts = 50
  sieve_quota_max_storage = 1M
}

touch /sbin/addmail
chmod +x /sbin/addmail

#!/bin/bash


USAGE="Usage: $0 EMAIL";

if [ ! -n "$1" ]
then
  echo $USAGE;
  exit 1;
fi
regex="^[a-z0-9!#\$%&'*+/=?^_\`{|}~-]+(\.[a-z0-9!#$%&'*+/=?^_\`{|}~-]+)*@([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z0-9]([a-z0-9-]*[a-z0-9])?\$"
if [[ $1 =~ $regex ]] ; then
    email=$1;
else
    echo "Wrong email format."
    exit 1;
fi
echo -n Enter user password:
read -s password
echo

echo $email":"$(doveadm pw -p $password)"::::" >> /etc/dovecot/users
service dovecot reload
echo Done.

add-apt-repository ppa:chris-lea/redis-server
apt-get update
apt-get install redis-server
apt-get install -y lsb-release wget # optional
CODENAME=`lsb_release -c -s`
wget -O- https://rspamd.com/apt-stable/gpg.key | apt-key add -
echo "deb [arch=amd64] http://rspamd.com/apt-stable/ $CODENAME main" > /etc/apt/sources.list.d/rspamd.list
echo "deb-src [arch=amd64] http://rspamd.com/apt-stable/ $CODENAME main" >> /etc/apt/sources.list.d/rspamd.list
apt-get update
apt-get --no-install-recommends install rspamd
rspamadm configwizard

root@mail:/etc/postfix# rspamadm configwizard
  ____                                     _
 |  _ \  ___  _ __    __ _  _ __ ___    __| |
 | |_) |/ __|| '_ \  / _` || '_ ` _ \  / _` |
 |  _ < \__ \| |_) || (_| || | | | | || (_| |
 |_| \_\|___/| .__/  \__,_||_| |_| |_| \__,_|
             |_|
 
 
Welcome to the configuration tool
We use /etc/rspamd/rspamd.conf configuration file, writing results to /etc/rspamd
Modules enabled: mime_types, hfilter, phishing, dkim_signing, asn, settings, regexp, arc, trie, bayes_expiry, rspamd_update, rbl, ip_score, metadata_exporter, elastic, fuzzy_check, mid, multimap, chartable, surbl, dkim, maillist, once_received, emails, dmarc, forged_recipients, milter_headers, whitelist, force_actions, spf
Modules disabled (explicitly): spamtrap, url_tags, mx_check, url_reputation
Modules disabled (unconfigured): spamassassin, reputation, metric_exporter, dynamic_conf, antivirus, fuzzy_collect, dcc, maps_stats, clickhouse
Modules disabled (no Redis): greylist, url_redirector, replies, neural, ratelimit, history_redis
Modules disabled (experimental):
Modules disabled (failed):
Do you wish to continue?[Y/n]: y
Setup WebUI and controller worker:
Controller password is not set, do you want to set one?[Y/n]: n
Redis servers are not set:
The following modules will be enabled if you add Redis servers:
* greylist
* url_redirector
* replies
* neural
* ratelimit
* history_redis
Do you wish to set Redis servers?[Y/n]: y
Input read only servers separated by `,` [default: localhost]:
Input write only servers separated by `,` [default: localhost]:
Do you have any password set for your Redis?[y/N]:
Do you have any specific database for your Redis?[y/N]:
Do you want to setup dkim signing feature?[y/N]: y
Enter output directory for the keys [default: /var/lib/rspamd/dkim/]:
Enter domain to sign: domain1.ru
Enter selector [default: dkim]:
Do you want to create privkey /var/lib/rspamd/dkim/domain1.ru.dkim.key[Y/n]:
To make dkim signing working, you need to place the following record in your DNS zone:
dkim._domainkey IN TXT ( "v=DKIM1; k=rsa; "
"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHoXvfq8caMJdEMmCpDqw0ghmw5eCvT9bIpnyaUeCWfCXoyPJTg2KtMfNEgybOernM+nDFugemVziOJOawAA/R/dfHtTGVaqlbmOuwKdoNHfyI4DLrsp6a6ZnWRw6GGj2/Di0wI1F32+dAlOwIDAQAB" ) ;
 
 
Do you wish to add another DKIM domain?[y/N]:Y

Enter domain to sign: domain12ru
Enter selector [default: dkim]:
Do you want to create privkey /var/lib/rspamd/dkim/domain2.ru.dkim.key[Y/n]:
To make dkim signing working, you need to place the following record in your DNS zone:
dkim._domainkey IN TXT ( "v=DKIM1; k=rsa; "
"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHoXvfq8caMJdEMmCpDqw0ghmw5eCvT9bIpnyaUeCWfCXoyPJTg2KtMfNEgybOernM+nDFugemVziOJOawAA/R/dfHtTGVaqlbmOuwKdoNHfyI4DLrsp6a6ZnWRw6GGj2/Di0wI1F32+dAlOwIDAQAB" ) ;




You have 1 sqlite classifiers
Expire time for new tokens [100d]:
Reset previous data?[y/N]: y~
Do you wish to convert them to Redis?[Y/n]: y
Convert spam tokens
 
 
Convert ham tokens
 
 
Migrated 0 tokens for 2 users for symbols (BAYES_SPAM, BAYES_HAM)
Converted classifier to the from sqlite to redis
File: /etc/rspamd/local.d/classifier-bayes.conf, changes list:
backend => redis
new_schema => true
expire => 8640000
 
 
File: /etc/rspamd/local.d/redis.conf, changes list:
write_servers => localhost
read_servers => localhost
 
 
File: /etc/rspamd/local.d/dkim_signing.conf, changes list:
domain => {[domain1.ru] = {[selector] = dkim, [privkey] = /var/lib/rspamd/dkim/domain1.ru.dkim.key}}
 
 
Apply changes?[Y/n]: y
Create file /etc/rspamd/local.d/classifier-bayes.conf
Create file /etc/rspamd/local.d/redis.conf
Create file /etc/rspamd/local.d/dkim_signing.conf
3 changes applied, the wizard is finished now
*** Please reload the Rspamd configuration ***

apt-get install nginx

....
    location / {
    proxy_pass       http://localhost:11334/;
 
    proxy_set_header Host      $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For "";
}
....

/etc/init.d/nginx restart

/etc/rspamd/local.d/dkim_signing.conf

try_fallback = false;
selector_map = "/etc/rspamd/dkim_selectors.map";
path_map = "/etc/rspamd/dkim_paths.map";

domain1.ru dkim
domain2.ru dkim

domain1.ru /var/lib/rspamd/dkim/domain1.ru.$selector.key
domain2.ru /var/lib/rspamd/dkim/domain1.ru.$selector.key

/var/lib/rspamd/dkim/domain1.ru.mail.key
/var/lib/rspamd/dkim/domain2.ru.mail.key

  IP_WHITELIST {
      type = "ip";
      prefilter = "true";
      map = "/${LOCAL_CONFDIR}/local.d/ip_whitelist.map";
      action = "accept";
  }
 
 
WHITELIST_SENDER_DOMAIN {
      type = "from";
      filter = "email:domain";
      map = "/etc/rspamd/local.d/whitelist.sender.domain.map";
      score = -10.0
  }

#тут наша локалка
192.168.0.0/24

domain1.ru
domain2.ru

/etc/init.d/rspamd restart

relayhost = [192.168.0.100]:submission  (тут локальный айпи нашего релея)
smtp_tls_security_level = encrypt
smtp_sasl_tls_security_options = noanonymous

smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_auth_enable = yes

[192.168.0.100]:submission relay@domain2.eu:PaSSw0RdXXX
# тут IP relay и специальный аккаунт для отсылки любой почты через relay, который мы создадим на relay

postmap /etc/postfix/sasl_passwd
service postfix reload