Hello all,I'm in the process of migrating my vps from Debian to OpenBSD and with that migrating my mail relay from Postfix to OpenBSD. I just now joined this list to tap into the hive mind :)
One challenge I could use some help or hints is the following. With my current postfix setup incomming mail from trusted systems (mynetworks in postfix) is treated different than mail from untrusted systems. One way I take advantage of this is that I do not allow untrusted systems to send mail with a from containing my domains.
Would it be possible to handle incoming mail from trusted systems different from incoming mail from untrusted systems? I have a listen-er with a filter named blocklist_sender_from which blocks mail from my domains, always. I could setup a listener on a non-standard port just for receiving mail from trusted systems, but I prefer to use standard ports if possible.
BDW, I've attached my current smtpd.conf THNX && GRTNX, RobJE
# most of this configuration is reused configuration from # - https://bsd-audit.com/self-hosting/running-your-own-mailserver/ # - https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-dovecot-and-rspamd/ #some variables ext_ipv4="46.23.90.102" ext_ipv6="2a03:6000:6f62:627::102" localhost_ipv4="127.0.0.1" localhost_ipv6="::1" ### Tables # Primary tables for mailboxes table aliases file:/etc/mail/aliases table domains file:/etc/mail/domains table valid_recipients file:/etc/mail/relay_recipients table allowed_ip_addresses file:/etc/mail/allowed_ip_addresses # Other tables table bad_rdns_regexes file:/etc/mail/block-rdns-regexes.list table bad_sender_from_regexes file:/etc/mail/block-sender-regexes.list table bad_sender_domains file:/etc/mail/block-sender-domains.list ### Filters # Filter to combat spam filter rspamd proc-exec "filter-rspamd" filter connect_exceptions phase connect match src <allowed_ip_addresses> bypass filter check_fcrdns phase connect match !fcrdns reject "550 no FCrDNS is so 80s" filter check_rdns phase connect match !rdns reject "550 no rDNS is so 80s" filter check_rdns_regex phase connect match rdns regex <bad_rdns_regexes> reject "550 rDNS blocked" filter blocklist_sender_from phase mail-from match mail-from regex <bad_sender_from_regexes> reject "550 bad sender?" filter check_valid_to phase rcpt-to match !rcpt-to regex <valid_recipients> reject "550 5.1.1 Recipient address rejected" ### Certificates pki vps.renf.us cert "/etc/ssl/vps.renf.us.fullchain.pem" pki vps.renf.us key "/etc/ssl/private/vps.renf.us.key" ### Listeners # socket listener listen on socket # local loopback listener listen on lo0 # external listener smtp+starttls listen on $ext_ipv4 port 25 tls pki vps.renf.us protocols "secure" ciphers "secure" filter { connect_exceptions, blocklist_sender_from, check_valid_to, check_fcrdns, check_rdns, check_rdns_regex, rspamd } listen on $ext_ipv6 port 25 tls pki vps.renf.us protocols "secure" ciphers "secure" filter { connect_exceptions, blocklist_sender_from, check_valid_to, check_fcrdns, check_rdns, check_rdns_regex, rspamd } # external listener smtps listen on $ext_ipv4 port 465 smtps pki vps.renf.us protocols "secure" ciphers "secure" filter { connect_exceptions, blocklist_sender_from, check_valid_to, check_fcrdns, check_rdns, check_rdns_regex, rspamd } listen on $ext_ipv6 port 465 smtps pki vps.renf.us protocols "secure" ciphers "secure" filter { connect_exceptions, blocklist_sender_from, check_valid_to, check_fcrdns, check_rdns, check_rdns_regex, rspamd } ### Actions action "relay_renf" relay host smtps://threis.easyenough.it action "local_mail" mbox alias <aliases> action "outbound" relay ### Matches # forward external mail to renf match ! from src <allowed_ip_addresses> for domain <domains> action "relay_renf" match from src <allowed_ip_addresses> for any action "outbound" # local mail can be delivered to local aliases match from local for local action "local_mail" # The local system may send mail out if needed match from local for any action "outbound"
