.ifdef SRS_SECRET

  .ifdef DCconfig_internet

  outbound_srs:
    debug_print = "R: SRS outbound for $local_part@$domain original $original_local_part@$original_domain"
    driver =    dnslookup
    # if outbound, and forwarding has been done, use an alternate transport
    domains =   ! +local_domains
    condition = ${if !eq {$local_part@$domain} \
                         {$original_local_part@$original_domain}}
    transport = remote_forwarded_smtp

  .elifdef DCconfig_smarthost DCconfig_satellite

  outbound_srs_smarthost:
    debug_print = "R: SRS outbound smarthost for $local_part@$domain original $original_local_part@$original_domain"
    driver =    dnslookup
    # if outbound, and forwarding has been done, use an alternate transport
    domains =   ! +local_domains
    condition = ${if !eq {$local_part@$domain} \
                         {$original_local_part@$original_domain}}
    transport = remote_forwarded_smtp_smarthost

  .endif
  
  inbound_srs:
    debug_print = "R: inbound_srs for $local_part@$domain"
    driver =    redirect
    senders =   :
    domains =   +local_domains
    # detect inbound bounces which are SRS'd, and decode them
    condition = ${if inbound_srs {$local_part} {SRS_SECRET}}
    data =      $srs_recipient
  
  inbound_srs_failure:
    debug_print = "R: inbound_srs_failure for $local_part@$domain"
    driver =    redirect
    senders =   :
    domains =   +local_domains
    # detect inbound bounces which look SRS'd but are invalid
    condition = ${if inbound_srs {$local_part} {}}
    allow_fail
    data =      :fail: Invalid SRS recipient address

.endif