1Local delivery models
2
3The "monolithic" model: recursively expand the complete initial
4recipient list (via aliases, mailing lists, .forward files) to one
5expanded recipient list (mail addresses, shell commands, files,
6mailboxes).  Sort/uniq the expanded recipient list, and deliver.
7
8The "forward as if sent by recipient" model: each level of recursion
9(aliases, mailing lists, forward files) takes one entire iteration
10through the mail system.  Non-recursively expand one local recipient
11(via alias, mailing list, the recipient's .forward file) to a list
12of expanded recipients.  Sort/uniq the list and deliver by re-injecting
13messages into the mail system.  Since recipient expansion uses a
14non-recursive algorithm, the mailer might loop indefinitely,
15re-injecting messages into itself. These local forwarding loops
16must be broken by stamping a message when it reaches the local
17delivery stage (e.g., by adding a Delivered-To:  message header).
18
19The Postfix system uses a hybrid approach. It does recursive alias
20expansion, but only one initial recipient at a time.  It delivers
21to expanded recipients by re-submitting the message into the mail
22system, so it can keep track of the delivery status for each expanded
23recipient. Because alias expansion does not look in .forward files,
24it cannot prevent local forwarding loops.  The Postfix system adds
25Delivered:  message headers to break local and external forwarding
26loops.
27
28Delivery status management
29
30The "exact" model: maintain on file the delivery status of each
31expanded recipient: remote recipients, shell commands and files,
32including the privileges for delivery to shell commands and files.
33
34The "safe" model: maintain on file only the delivery status of
35non-sensitive destinations (local or remote addresses). Deliver to
36sensitive destinations first (commands, files), but do not keep a
37record of their status on file (including privileges). This means
38that the mail system will occasionally deliver the same message
39more than once to a file or command.
40