On Mon, 10 Jan 2011 23:04:31 +0100, mouss <[email protected]> wrote: > Le 10/01/2011 10:33, Mark Alan a écrit : > > Well then, would the following order make sense? > > > > smtpd_recipient_restrictions = sleep 1, > > reject_unlisted_recipient, reject_unauth_pipelining, > > reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, > > reject_non_fqdn_sender, reject_non_fqdn_recipient, > > reject_unknown_sender_domain, reject_unknown_recipient_domain, > > permit_sasl_authenticated, permit_mynetworks, > > reject_unauth_destination,check_policy_service inet:127.0.0.1:10031 > > > > make that > > > smtpd_recipient_restrictions = > reject_non_fqdn_sender > reject_non_fqdn_recipient > permit_sasl_authenticated > permit_mynetworks > reject_unauth_destination > sleep 1 > reject_unlisted_recipient > reject_unlisted_sender > reject_invalid_helo_hostname > reject_non_fqdn_helo_hostname > #reject_unknown_sender_domain > #reject_rbl_client zen.spamhaus.org > check_policy_service${policy_service} > > details: > > - I am assuming that: you should queue errors for your own users (so > permit_* comes soon)
Thank you for your time mouss. I do not fully understood that. Lets see if I am able to follow you: Only after reject_unauth_destination, we start to analyze strangers that were already checked to have a proper fqdn'ized mail to our domain: reject_unlisted_recipient: reject unknown recipient addresses reject_unlisted_sender: reject unknown sender addresses reject_invalid_helo_hostname: reject invalid (HE\|EH)LO host syntax reject_non_fqdn_helo_hostname: reject if (HE\|EH)LO not RFC fqdn > - reject_unknown_recipient_domain is only uselful in an MSA. and even > then... (you want to bounce not reject. because MUAs are bad I see your point and I deleted it. Regarding 'reject_unlisted_sender', I am not able to see your point. > - reject_unauth_pipelining is useless here. check the pipelining > specs. (RCPT TO is an async command...) I use 'smtpd_delay_reject = yes' man 5 postconf | less +/per-session\ flag shows this: 'With Postfix 2.6 and later, the SMTP server sets a per-session flag whenever it detects illegal pipelining, including pipelined EHLO or HELO commands. The reject_unauth_pipelining feature simply tests whether the flag was set at any point in time during the session.' I thought that this would assure that reject_unauth_pipelining would also do its work inside smtpd_recipient_restrictions. > - experience here shows that reject_unknown_sender_domain only > rejets legit mail. This I do not understand, because also from man 5 postconf: 'when Postfix is not final destination for the sender address, and the MAIL FROM address has no DNS A or MX record, or when it has a malformed MX record' If our server is not the final destination AND it may happen that there is no A and, at the same time, MX has problems. Best regards, M.
