The right thing™ to do, is to build maps that were built from files who were built from LDAP queries run against the Exchanges' ADS. Huh?

Warning

Probably the first impulse will be to have Postfix do LDAP lookups on demand by connecting to the Exchange Server through LDAP and query for valid recipients. This is not recommended, because in critical situations e.g. during a dictionary attack there will be thousands of queries a minute, distracting the Exchange server from its primary job being a groupware server. There will be so many queries that the Exchange server will slow down so badly that the dictionary attack will result in a DoS to your groupware server.

The Exchange server can be queried for valid recipients using LDAP. However in a big Exchange Server installation there is a default limit that might permit a query from getting all valid recipients; a regular query is allowed to return at most 1.000 results. After that the server will not answer and further requests by the source that seeks recipients.

The solution is to use Microsoft's own scripting language and write a Visual Basic script that will tell the LDAP server not to give all results at once, but to hand them out in pages. The following steps sketch a way how to query an Exchange Server for valid recipients, copy them to the Postfix mailrelay and have Postfix use them to reject unknown recipients before they reach the Exchange Server.

The idea is to have a script query an Exchange server for proxyAddresses which is the correct attribute when you are looking for valid recipients.

Edit the script and change Set Container=GetObject("LDAP://CN=Users,DC=office,DC=example,DC=com") to fit your LDAP structure.

' Export all valid recipients (= proxyAddresses) into a
' file virtual.txt
'
' Ferdinand Hoffmann & Patrick Koetter
' 20021100901
' Shamelessly stolen from 
' http://www.microsoft.com/windows2000/techinfo/ \
' planning/activedirectory/bulksteps.asp


'Global variables
Dim Container
Dim OutPutFile
Dim FileSystem

'Initialize global variables
Set FileSystem = WScript.CreateObject("Scripting.FileSystemObject")
Set OutPutFile = FileSystem.CreateTextFile("virtual.txt", True)
Set Container=GetObject("LDAP://CN=Users,DC=office,DC=example,DC=com")

'Enumerate Container
EnumerateUsers Container

'Clean up
OutPutFile.Close
Set FileSystem = Nothing
Set Container = Nothing

'Say Finished when your done
WScript.Echo "Finished"
WScript.Quit(0)

'List all Users
Sub EnumerateUsers(Cont)
Dim User

'Go through all Users and select them
For Each User In Cont
Select Case LCase(User.Class)

'If you find Users
Case "user"
  'Select all proxyAddresses
  Dim Alias
  If Not IsEmpty(User.proxyAddresses) Then
    For Each Alias in User.proxyAddresses
    OutPutFile.WriteLine "alias: " & Alias
    'WScript.Echo Alias
  Next
  End If

Case "organizationalunit" , "container"
  EnumerateUsers User

End Select
Next
End Sub

Run the script and check the output. It should give you something like this:

alias: SMTP:newuser3@office.example.com 
alias: SMTP:newuser@office.example.com
alias: SMTP:Administrator@office.example.com
alias: X400:c=us;a= ;p=Example Organiza;o=Exchange;s=Administrator;
alias: smtp:postmaster@office.example.com 
alias: X400:c=us;a= ;p=Example Organiza;o=Exchange;s=Doe;g=Jon;
alias: SMTP:testuser@example.com
alias: SMTP:postfix@office.example.com
alias: X400:c=us;a= ;p=Example Organiza;o=Exchange;s=postfix;

	SMTP is a valid recipient and it is a users mail address that any outgoing message will be rewritten to
	smtp as an alias and a valid recipient for a user.

Install and configure any secure copy mechanism, e.g. PuTTY to scp virtual.txt to the Postfix machine using key files for unattended copying. You can also use rsync over ssh from the cygwin package.

Use the Windows Scheduler to run export_recipients.vbs and scp as often as needed.

Parse the virtual.txt file for smtp and SMTP entries and write them into a Postfix map format to relay_recipients.proto. Then run postmap /path/to/relay_recipients.proto to make it a Postfix readable DB. We use this Makefile which can be invoked from cron using: cd /etc/postfix && make

DB=db
all:    relay_recipients.$(DB)
# "all" means to build virtual.db

relay_recipients.proto:       virtual.txt
    awk -F: '/alias: (SMTP|smtp):/ {printf("%s\tOK\n",$$3)}' virtual.txt > relay_recipients.proto
# We need virtual.txt to build relay_recipients.proto
# awk will use ":" as field separator and for each line
# that contains "alias: (SMTP|smtp):" it will do:
# print the third row, insert a TAB, insert "OK" and add a newline
# into relay_recipients.proto

%.$(DB):             %.proto
    /usr/sbin/postmap $*.proto && mv $*.proto.$(DB) $*.$(DB)
# Building a *.db requires a *.proto file. If that exists,
# postmap is called to build the map from *.proto. If postmap is successful
# the *.proto map will be renamed to *.db

Once the makefile has built the recipient map we need to configure Postfix to make use of the map. We must also tell Postfix where to transport messages to as soon as they have passed the recipient test. In /etc/postfix/main.cf we add these parameters:

relay_domains = office.example.com, example.com
relay_recipient_maps = hash:/etc/postfix/relay_recipients
transport_maps = hash:/etc/postfix/transport

The parameter transport_maps in main.cf points to the location of the transport map. The map contains entries that tell Postfix how and where to transport messages for a given recipient domain to.

Example 4. /etc/postfix/transport

domain    smtp:[ho.st.na.me] 
domain    smtp:[ip.ad.dr.es] 

	Hostnamens must be fully quallified domain names resolvable by Postfix. Note You may not be able to configure your DNS server to provide a separate MX entry for the host that messages should be transported to. In that case you simply put the hostname in square brackets and Postfix will not use the default MX a DNS-query would return.
	Use an IP-Address, if Postfix cannot not resolve the hostname of the exchange server. Note that you must put the IP-Adress in square brackets.

Finally make Postfix reload it's configuration and it's maps by executing postfix reload.