At one time I tried to do it all in Postfix. It's all or nothing binary
operation of its Spam rules drove me to find another solution to Spam;
SpamAssassin. Now a triggered rule only adds to a Spamminess value, and
won't kill the message. I ultimately took almost all the rules out of
Postfix because I couldn't keep up with the false positives they created.
All the FQDN, MX, an A record checks were removed due to false positives...
The check_* restrictions implement white and black listing.
smtpd_recipient_restrictions =
check_recipient_access hash:$config_directory/smtpd-recipient-checks,
permit_mynetworks,
reject_invalid_hostname,
reject_unauth_destination,
check_recipient_access regexp:$config_directory/smtpd-recipient-checks.rx,
check_sender_access hash:$config_directory/smtpd-sender-checks,
check_sender_access regexp:$config_directory/smtpd-sender-checks.rx,
check_client_access hash:$config_directory/smtpd-client-checks,
check_helo_access hash:$config_directory/smtpd-helo-checks,
reject_unknown_recipient_domain
smtpd_data_restrictions =
reject_unauth_pipelining
Dan
-Original Message-
From: Menno van Bennekom [mailto:[EMAIL PROTECTED]
Sent: Tuesday, December 07, 2004 5:45 AM
To: users@spamassassin.apache.org
Cc: David Newman
Subject: SA vs. postfix main.cf
We run postfix 2.1.5_1,1 on FreeBSD 5.2.1, and use some RBL lists:
smtpd_recipient_restrictions =
...
reject_rbl_client opm.blitzed.org,
reject_rbl_client list.dsbl.org,
reject_rbl_client proxies.relays.monkeys.com,
reject_rbl_client relays.ordb.org,
reject_rbl_client bl.spamcop.net,
reject_rbl_client sbl.spamhaus.org
We are seeing cases where mail is rejected because of the
RBL lists,
even when a sender is whitelisted in a recipient's SA
user_prefs file.
Is there any way to reverse the order of operations so that postfix
doesn't check with the RBL list when SA says a sender is OK?
You can't reverse the checks, but you can whitelist
addresses in Postfix.
I use the check_client_access to allow certain domains/ips
to send mail although they appear in RBL's. Just put them in
the access-file with 'OK'
on the end of the line. You can do the same with check_sender_access.
And make sure this check is done before the RBL checks, like:
smtpd_recipient_restrictions = reject_non_fqdn_sender,
reject_non_fqdn_recipient,
permit_mynetworks,
reject_unauth_destination,
check_client_access hash:/etc/postfix/client_access,
check_helo_access hash:/etc/postfix/helo_access,
check_sender_access hash:/etc/postfix/sender_access,
reject_rbl_client dynablock.njabl.org,
reject_rbl_client dul.dnsbl.sorbs.net,
reject_rbl_client cbl.abuseat.org
Regards
Menno van Bennekom
