--- a/manifests/nodes.pp	Tue Mar 03 20:26:15 2020 +0000
+++ b/manifests/nodes.pp	Sat Mar 07 14:29:34 2020 +0000
@@ -20,8 +20,10 @@
 		primary_ip => '2a00:1098:82:52::1',
 		proxy_4to6_ip_prefix => '2a00:1098:82:52::01d4', # ::old4 for IPv4!
 		proxy_upstream => ['2a00:1098::82:1000:3b:1:1', '2a00:1098::80:1000:3b:1:1'],
+		nat64_ranges => ['2a00:1098:0:80:1000:3a::/96', '2a00:1098:0:82:1000:3a::/96'],
 		mailserver => 'mail.ibboard.co.uk',
 		imapserver => 'imap.ibboard.co.uk',
+		mailrelays => ['mx.mythic-beasts.com'],
 		firewall_cmd => 'iptables',
 	}
 	# If the console fails to start, you may need to run "restorecon /etc/systemd/system/getty.target.wants/*"

--- a/manifests/templates.pp	Tue Mar 03 20:26:15 2020 +0000
+++ b/manifests/templates.pp	Sat Mar 07 14:29:34 2020 +0000
@@ -30,8 +30,10 @@
 	$primary_ip,
 	$proxy_4to6_ip_prefix = undef,
 	$proxy_upstream = undef,
+	$nat64_ranges = [],
 	$mailserver,
 	$imapserver,
+	$mailrelays = [],
 	$firewall_cmd = 'iptables',
 	) {
 
@@ -89,6 +91,8 @@
 		mailserver_ip => $primary_ip,
 		proxy_ip => $proxy_4to6_ip_prefix != undef ? { true => "${proxy_4to6_ip_prefix}:10", default => undef },
 		proxy_upstream => $proxy_upstream,
+		nat64_ranges => $nat64_ranges,
+		mailrelays => $mailrelays,
 	}
 }
 
@@ -470,16 +474,20 @@
 	$primary_ip,
 	$proxy_4to6_ip_prefix = undef,
 	$proxy_upstream = undef,
+	$nat64_ranges = [],
 	$mailserver,
 	$imapserver,
+	$mailrelays = [],
 	$firewall_cmd = 'iptables',
 	){
 	class { 'basevpsnode':
 		primary_ip => $primary_ip,
 		proxy_4to6_ip_prefix => $proxy_4to6_ip_prefix,
 		proxy_upstream => $proxy_upstream,
+		nat64_ranges => $nat64_ranges,
 		mailserver => $mailserver,
 		imapserver => $imapserver,
+		mailrelays => $mailrelays,
 		firewall_cmd => $firewall_cmd,
 	}
 
@@ -713,12 +721,16 @@
 	$mailserver_ip,
 	$proxy_ip = undef,
 	$proxy_upstream = [],
+	$nat64_ranges = [],
+	$mailrelays = [],
 	){
 	class { 'postfix':
 		mailserver => $mailserver,
 		mailserver_ip => $mailserver_ip,
 		mailserver_proxy => $proxy_ip,
 		proxy_upstream => $proxy_upstream,
+		mailrelays => $mailrelays,
+		nat64_ranges => $nat64_ranges,
 		protocols  => $mailserver_ip =~ Stdlib::IP::Address::V6 ? { true => 'all', default => 'ipv4' },
 	}
 	class { 'dovecot':

--- a/modules/postfix/manifests/init.pp	Tue Mar 03 20:26:15 2020 +0000
+++ b/modules/postfix/manifests/init.pp	Sat Mar 07 14:29:34 2020 +0000
@@ -3,9 +3,10 @@
   Stdlib::IP::Address $mailserver_ip,
   Optional[Stdlib::IP::Address::V6] $mailserver_proxy = undef,
   Array[Stdlib::IP::Address::V6] $proxy_upstream = [],
+  Optional[Array[Stdlib::Host]] $mailrelays = [],
+  Optional[Array[Stdlib::IP::Address::V6]] $nat64_ranges = [],
   Enum['all', 'ipv4', 'ipv6'] $protocols='all'
   ){
-
   if $mailserver_ip =~ Stdlib::IP::Address::V4 {
     $lo_ip = '127.0.0.1'
     $lo_networks = '127.0.0.0/8'
@@ -45,6 +46,18 @@
     }
   }
 
+  $nat64_ranges.each |Stdlib::IP::Address::V6 $nat64_range| {
+    # Block SMTP to the NAT64 range so that we don't fail SPF checks
+    # The server *should* attempt it then fall back to the relay
+    firewall { "200 Prevent SMTP over NAT64 to $nat64_range":
+      destination => $nat64_range,
+      dport => [25, 265, 587],
+      proto => tcp,
+      action => 'reject',
+      chain => 'OUTPUT',
+    }
+  }
+
   exec { 'postmap-files':
     command     => 'for file in helo_whitelist recipient_bcc sender_access valias valias-blacklist virtual vmailbox transport; do postmap $file; done',
     cwd         => '/etc/postfix/',
@@ -74,6 +87,7 @@
                      'mailserver_proxy' => $mailserver_proxy,
                      'lo_ip' => $lo_ip,
                      'lo_networks' => $lo_networks,
+                     'fallback_relays' => $mailrelays,
                    }
                   ),
   }

--- a/modules/postfix/templates/master.cf.epp	Tue Mar 03 20:26:15 2020 +0000
+++ b/modules/postfix/templates/master.cf.epp	Sat Mar 07 14:29:34 2020 +0000
@@ -3,6 +3,7 @@
       Optional[Stdlib::IP::Address] $mailserver_proxy = undef,
       Stdlib::IP::Address $lo_ip,
       Stdlib::IP::Address $lo_networks,
+      Optional[Array[Stdlib::Host]] $fallback_relays = []
     |
 -%>
 #
@@ -77,6 +78,9 @@
   <%- } else { -%>
   -o smtp_bind_address=<%= $mailserver_ip %>
   <%- } -%>
+  <%- if size($fallback_relays) > 0 { -%>
+  -o smtp_fallback_relays=<%= join($fallback_relays.map |$relay| { "[$relay]" }, ", ") %>
+  <%- } -%>
 # When relaying mail as backup MX, disable fallback_relay to avoid MX loops
 relay     unix  -       -       n       -       -       smtp
 	-o smtp_fallback_relay=