# Basic
myhostname = lists.sasalliance.org
myorigin = sasalliance.org
mydestination = $myhostname, localhost.$mydomain, localhost

# Virtual alias domains - domains we handle via virtual_alias_maps
virtual_alias_domains = lists.sasalliance.org

# Relay through SES
relayhost = [${SMTP_HOST}]:${SMTP_PORT}
smtp_tls_security_level = encrypt
smtp_tls_note_starttls_offer = yes

# SASL auth for SES
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous

# Virtual aliases - dynamic MySQL lookup
virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf

# Sender restrictions - enforce whitelist
smtpd_sender_restrictions = 
    permit_mynetworks,
    check_sender_access hash:/etc/postfix/sender_access,
    reject

# Recipient restrictions - accept mail for our domains
smtpd_recipient_restrictions = 
    permit_mynetworks,
    reject_unauth_destination

# Other recommended settings
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases