Generic SMTP relay

RubySig's contract with a mail platform is small. Microsoft 365 and Google Workspace meet it with connectors and rules; anything else meets it with the same three pieces:

1. Route outbound mail to your relay address — <tenant>.smtp.rubysig.com, port 25, TLS with certificate verification.
2. Exempt mail that already carries X-RubySig-Stamped from that routing. This is the loop guard: RubySig adds the header to every message it hands back, and without the exemption your server would send the stamped copy straight back.
3. Accept the stamped message back from 167.233.237.1, as mail from your own domain, and deliver it as you normally would.

Your relay address is on the portal's Setup page. The shared values are under Connection values.

Note: RubySig never delivers to the internet on your behalf. The stamped message comes back to your server, and your server delivers it — so your SPF, reputation and outbound policy stay exactly as they are.

Postfix

A worked example for Postfix 3.x. Adapt paths to your distribution.

1. Send outbound mail to RubySig

In main.cf, make the relay your default next hop, with TLS enforced and the certificate checked against the hostname:

relayhost = [<tenant>.smtp.rubysig.com]:25
smtp_tls_security_level = secure
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_secure_cert_match = nexthop

secure with nexthop matching is the equivalent of Microsoft's subject name matches this domain setting: Postfix will refuse to hand mail to anything that cannot present a valid certificate for your exact relay address.

2. Exempt stamped mail

Postfix cannot make a routing decision on a header directly, but header_checks can switch a message to a different transport. Add to main.cf:

header_checks = regexp:/etc/postfix/rubysig_header_checks

and create /etc/postfix/rubysig_header_checks:

/^X-RubySig-Stamped:\s*yes/   FILTER direct:

Then define the direct transport in master.cf — a plain SMTP transport that ignores relayhost and delivers by MX lookup:

direct    unix  -       -       n       -       -       smtp
  -o smtp_fallback_relay=
  -o relayhost=

Result: unstamped mail goes to RubySig; stamped mail, which is only ever the copy RubySig handed back, goes straight to the recipient's MX.

3. Accept the hand-back

The relay connects to your server — the smart host set for your tenant in RubySig, usually your own MX — from 167.233.237.1, with STARTTLS, as the original sender. Your server must accept mail from that address for your own domains without treating it as a foreign relay attempt. In main.cf:

mynetworks = 127.0.0.0/8, [::1]/128, 167.233.237.1/32

If you restrict senders by domain, allow your own sending domains for that source. Do not require SMTP authentication for it; the source address is the authentication, as it is for Microsoft's inbound connector and Google's relay allow-list.

4. Reload and test

postfix reload

Send a message from a mailbox in your directory to an external address you control and check the received headers for X-RubySig-Stamped: yes, a Received: line from relay.rubysig.com, and dkim=pass for your domain — see Verifying your setup.

Other platforms

The same three pieces, by their local names:

DNS

Same as every platform: publish the DKIM record from the portal's Setup page — see DKIM — and optionally add the relay's addresses to your SPF record, SPF & DMARC.

What RubySig needs from you

Your tenant's hand-back host — the hostname and port the relay should deliver stamped mail to (your MX, typically). It is set on your tenant during onboarding; tell us if it changes.