Le 10/01/2011 10:33, Mark Alan a écrit :
> On Sun, 9 Jan 2011 10:17:57 -0500 (EST), Wietse Venema
> <[email protected]> wrote:
>
>> Jan Johansson:
>>> I have the following config:
>>>
>>> smtpd_recipient_restrictions = permit_mynetworks
>>> reject_unauth_destination check_policy_service inet:127.0.0.1:10031
>>>
>> For that, specify reject_unlisted_recipient before permit_mynetworks.
>
> Well then, would the following order make sense?
>
> smtpd_recipient_restrictions = sleep 1,
> reject_unlisted_recipient, reject_unauth_pipelining,
> reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname,
> reject_non_fqdn_sender, reject_non_fqdn_recipient,
> reject_unknown_sender_domain, reject_unknown_recipient_domain,
> permit_sasl_authenticated, permit_mynetworks,
> reject_unauth_destination,check_policy_service inet:127.0.0.1:10031
>
make that
smtpd_recipient_restrictions =
reject_non_fqdn_sender
reject_non_fqdn_recipient
permit_sasl_authenticated
permit_mynetworks
reject_unauth_destination
sleep 1
reject_unlisted_recipient
reject_unlisted_sender
reject_invalid_helo_hostname
reject_non_fqdn_helo_hostname
#reject_unknown_sender_domain
#reject_rbl_client zen.spamhaus.org
check_policy_service${policy_service}
details:
- I am assuming that: you should queue errors for your own users (so
permit_* comes soon)
- reject_unknown_recipient_domain is only uselful in an MSA. and even
then... (you want to bounce not reject. because MUAs are bad when it
comes to reject).
- reject_unauth_pipelining is useless here. check the pipelining specs.
(RCPT TO is an async command...)
- exeperience here shows that reject_unknown_sender_domain only rejects
legit mail.
