Outbound IP addresses

Mail to other servers can leave from addresses you choose, instead of the server's one address:

a pool of IPv4 addresses, shared by every team, or dedicated to one team so that other teams' mail never affects its reputation;
with an IPv6 prefix, an IPv6 address of every domain's own, so each domain builds its own reputation.

Set it up in the Mailocity panel, Settings → Outbound IPs, or with corpsuite ip-pool and corpsuite ip-settings.

Which address mail leaves from

For each message, from its sender's domain:

IPv4: one of the team's dedicated addresses when it has any, otherwise one of the shared ones. A domain always gets the same one of them, so its reputation stays with one address.
IPv6 (with a prefix and a name base set): the domain's own address, made from the domain's name, so it never changes while the prefix does not.
With Send over IPv6 first, the server tries IPv6 when the receiving server has an IPv6 address, then IPv4.

Without any pool address, mail leaves from the server's own address with its host name, as before.

The server says each address's own name in EHLO. Receivers check that the address's PTR (reverse DNS) is that name and that the name points back at the address: set both (see below), or many receivers refuse the mail.

SPF

Each domain's SPF record lists the addresses its mail may leave from: its team's pool addresses (ip4:) and its own IPv6 address (ip6:), then the server's name as before. A shared domain lists every pool address, since its users belong to many teams. The DNS list on the domain's page shows the record to publish; Automatic DNS keeps it right by itself. Adding or removing pool addresses changes SPF records, so publish them again.

Making the addresses work on the server

The server binds each address when it connects, with Linux's FREEBIND option: an address need not be configured on an interface, only routed to the host, and no extra privilege is needed.

IPv4: add each address to the server as usual (ip addr add 203.0.113.11/32 dev eth0), or route it to the host and set net.ipv4.ip_nonlocal_bind=1.
IPv6: have your provider route the prefix to the server, then make it local in one line (and in your network configuration so it stays):
```
ip -6 route add local 2001:db8:1:2::/64 dev lo
```

Outside Linux, addresses must be configured on an interface.

Names and PTR records

Each pool address has a name (its EHLO name and PTR), such as o1.mailo.city; each domain's IPv6 address is named x<10 hex>.<name base>, such as x1a2b3c4d5e.out.mailo.city.

Publish names and PTR records publishes, through Route53 with the server's own AWS credentials:

an A or AAAA record for each name in the forward zone (for example mailo.city);
a PTR record for each address in its reverse zone (for example 113.0.203.in-addr.arpa, or the ip6.arpa zone of the prefix), when that zone is in Route53.

Addresses whose reverse zone is elsewhere are named in the result: ask the provider of the addresses to set their PTR to the name.

Teams

A team sees where its mail leaves from on its page in the team manager (Where your mail leaves from: each domain's IPv4 and IPv6), or with corpsuite tenant sending-addresses TEAM.

Not yet

A warm-up schedule for new addresses (sending a little more each day).
Choosing addresses by recipient provider or message kind.