Tue, 08 Jan 2013 23:59:31 +0100 skrev mouss <[email protected]>: > > This raises the question (or at least I think it do), if it's > > possible to "force" the users onto 587 by denying relay access to > > 25? > > fix the problem at the source: force the client to do the work: > use different services for different uses: > > [MX service] > port: 25 > example DNS name: mx01.example.com > => no relay > virus and spam filtering... > > [submission service] > example DNS name: smtp01.example.com > port 587. if this is hard, port 25 with a specific IP is ok. > SASL auth. when not desirable, IP based access control (thoug this may > be implemented outside of postfix, such as on a firewall) > virus filtering > rate limit and custom checks as needed. > > [reverse MX] > example DNS name: mailrelay01.example.com > in small setups, this could be the same service as the submission one. > in larger setups, make this dedicated. it'll take the complexity of > mail routing and "caching" (retry). > > ... >
Thank you for the insights, together with a subdomain to the Dovecot IMAP service they have all been implemented so I later may split the services to multiple servers. However I'm not sure I understand the reverse MX part very well, perhaps I could trouble you for a link where I could do some reading on the subject?
