dovecot   unix  -       n       n       -       -       pipe
 flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -d ${recipient}

# we need to be permissive with the helo restrictions since the client can only
# authenticate after HELO has been sent
smtps      inet    n       -       n       -       -       smtpd
 -o smtpd_etrn_restrictions=reject
 -o smtpd_tls_security_level=may
 -o smtpd_tls_wrappermode=yes
 -o smtpd_sasl_type=dovecot
 -o smtpd_sasl_path=private/auth
 -o smtpd_sasl_auth_enable=yes
 -o smtpd_helo_restrictions=permit
 -o smtpd_client_restrictions=permit_sasl_authenticated,reject
 -o smtpd_sender_restrictions=permit_sasl_authenticated,reject
 -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
 -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject

spamassassin unix -     n       n       -       -       pipe
 user=vmail:vmail argv=/usr/bin/spamc -f -e
 /usr/sbin/sendmail -oi -f ${sender} ${recipient}