--- a/modules/postfix/manifests/init.pp	Tue Mar 03 20:26:15 2020 +0000
+++ b/modules/postfix/manifests/init.pp	Sat Mar 07 14:29:34 2020 +0000
@@ -3,9 +3,10 @@
   Stdlib::IP::Address $mailserver_ip,
   Optional[Stdlib::IP::Address::V6] $mailserver_proxy = undef,
   Array[Stdlib::IP::Address::V6] $proxy_upstream = [],
+  Optional[Array[Stdlib::Host]] $mailrelays = [],
+  Optional[Array[Stdlib::IP::Address::V6]] $nat64_ranges = [],
   Enum['all', 'ipv4', 'ipv6'] $protocols='all'
   ){
-
   if $mailserver_ip =~ Stdlib::IP::Address::V4 {
     $lo_ip = '127.0.0.1'
     $lo_networks = '127.0.0.0/8'
@@ -45,6 +46,18 @@
     }
   }
 
+  $nat64_ranges.each |Stdlib::IP::Address::V6 $nat64_range| {
+    # Block SMTP to the NAT64 range so that we don't fail SPF checks
+    # The server *should* attempt it then fall back to the relay
+    firewall { "200 Prevent SMTP over NAT64 to $nat64_range":
+      destination => $nat64_range,
+      dport => [25, 265, 587],
+      proto => tcp,
+      action => 'reject',
+      chain => 'OUTPUT',
+    }
+  }
+
   exec { 'postmap-files':
     command     => 'for file in helo_whitelist recipient_bcc sender_access valias valias-blacklist virtual vmailbox transport; do postmap $file; done',
     cwd         => '/etc/postfix/',
@@ -74,6 +87,7 @@
                      'mailserver_proxy' => $mailserver_proxy,
                      'lo_ip' => $lo_ip,
                      'lo_networks' => $lo_networks,
+                     'fallback_relays' => $mailrelays,
                    }
                   ),
   }