pki smtp.example.org cert ".../fullchain.pem"
pki smtp.example.org key ".../privkey.pem"

table domainst "/etc/smtpd/domains"
table senderst "/etc/smtpd/senders"
table srcban "/etc/smtpd/srcban"
table userst "/etc/smtpd/users"
table redsrcdom { smtp.foo.org }
table redrcpt { redirect@example.org }

listen on enp0s4 tls pki smtp.example.org auth-optional senders <senderst>
listen on enp0s4 smtps pki smtp.example.org auth-optional senders <senderst>
listen on enp0s4 port 587 tls-require pki smtp.example.org auth-optional senders <senderst>

listen on lo port 10026 tag PASS-IN mask-src
listen on lo port 10029 tag PASS-OUT mask-src

listen on localhost

action md mda "/usr/bin/maildrop -d %{user.username}"
action md_virt mda "/usr/bin/maildrop -d %{user.username}" virtual <userst>
action sa relay host smtp://localhost:10026
action no_sa relay host smtp://localhost:10024
action "relay" relay
action dkim relay host smtp://localhost:10028

match ! from local ! auth for any mail-from <srcban> reject

match tag PASS-IN for domain <domainst> action md_virt

match from src <redsrcdom> rcpt-to <redrcpt> action no_sa

match from any for domain <domainst> action sa

match for any tag PASS-OUT action "relay"

match from any auth for any action dkim
match for any action dkim