> On Feb 17, 2016, at 5:18 AM, Tobi <[email protected]> wrote:
>
> use a regexp on recipient and/or sender domain to reject such messages.
> postfix accepts underscore in domain names as this is a common mistake
> by many legitimate admins
There's little reason to do this. If the domain is resolvable, accept it,
if not reject.
smtpd_recipient_restrictions =
reject_unauth_destination,
reject_unknown_sender_domain,
...
mua_recipient_restrictions =
reject_plaintext_session,
permit_sasl_authenticated,
reject
On the incoming port 25 service the only "_" domains allowed will
be the OP's own domains, presumably he has none.
On the outbound port 587 service, MUAs generally react poorly when
a subset of the recipients of a message is invalid. It is often
better to accept the whole message and bounce what's undeliverable.
The main place for "reject_unknown_recipient_domain" is in dedicated
outbound smarthost relays, which can use:
smtpd_recipient_restrictions =
reject_non_fqdn_recipient,
reject_non_fqdn_sender,
reject_unknown_recipient_domain,
reject_unknown_sender_domain,
permit_mynetworks,
# Just in case mynetworks is not up to date with list of
# authorized relay clients.
defer
Whether accept and bounce is better depends on whether one is offering
email service to the unwashed masses, or to employees, family, ...
who are less likely to turn rogue.
--
Viktor.
