Re: postmulti behind NAT

2013-07-22 Thread Ulrich Zehl
On Sat, Jul 20, 2013 at 03:45:35PM -0500, /dev/rob0 wrote: > They don't have "hairpin NAT" set up, whereby if I try to connect to > this NATed IP address it would go to the router and come back to me. > I'm fine with that, actually; while that would solve the instant > problem, it could be bad i

Re: allow some senders, but block everyone else

2013-07-22 Thread Wietse Venema
Florin Andrei: > On 07/22/2013 05:30 PM, Wietse Venema wrote: > > Florin Andrei: > >> > >> The goal is to send most emails to local, send most mydomain.com > >> recipients to a relay nearby, and let foobardomain.com senders go out on > >> the Internet freely. > > > > Presumably, if foobardomain.com

Re: allow some senders, but block everyone else

2013-07-22 Thread Florin Andrei
On 07/22/2013 05:30 PM, Wietse Venema wrote: Florin Andrei: The goal is to send most emails to local, send most mydomain.com recipients to a relay nearby, and let foobardomain.com senders go out on the Internet freely. Presumably, if foobardomain.com senders send mail to local or mydomain.com

Re: allow some senders, but block everyone else

2013-07-22 Thread Wietse Venema
Florin Andrei: > Okay, let's try this: > > The goal is to send most emails to local, send most mydomain.com > recipients to a relay nearby, and let foobardomain.com senders go out on > the Internet freely. Presumably, if foobardomain.com senders send mail to local or mydomain.com recipients, th

Re: allow some senders, but block everyone else

2013-07-22 Thread Florin Andrei
Okay, let's try this: The goal is to send most emails to local, send most mydomain.com recipients to a relay nearby, and let foobardomain.com senders go out on the Internet freely. In main.cf I have: sender_dependent_default_transport_maps = regexp:/etc/postfix/sender_transport In sender_

Re: Whitelisting from reverse DNS checks

2013-07-22 Thread Noel Jones
On 7/22/2013 4:27 PM, L.W. van Braam van Vloten wrote: > Hi, > > Thanks for your clear reply, that really helps! > > One last question: How should I configure local_recipient_maps? The default setting of local_recipient_maps = proxy:unix:passwd.byname $alias_maps should be appropriate for the v

Re: allow some senders, but block everyone else

2013-07-22 Thread Wietse Venema
Florin Andrei: > This is a clone of the production site, for QA and testing. This being > QA, whenever we run a test of our software, we don't want our test suite > to go ahead and blast the Internet with lots of random email messages. > OTOH, we need to keep the configuration of the QA site as

Re: Whitelisting from reverse DNS checks

2013-07-22 Thread L.W. van Braam van Vloten
Hi, Thanks for your clear reply, that really helps! One last question: How should I configure local_recipient_maps? Noel said: local_recipient_maps = An empty local_recipient_maps will cause your postfix to accept mail for undeliverable local address, then attempt to bounce them.

allow some senders, but block everyone else

2013-07-22 Thread Florin Andrei
This is a clone of the production site, for QA and testing. This being QA, whenever we run a test of our software, we don't want our test suite to go ahead and blast the Internet with lots of random email messages. OTOH, we need to keep the configuration of the QA site as close to production as

Re: postmulti behind NAT

2013-07-22 Thread /dev/rob0
On Mon, Jul 22, 2013 at 08:51:37PM +0200, Jeroen Geilman wrote: > Why would you not allow submission to deliver to the hosted > domains ? You can simply add the maps to the existing ones > you use (if any). The point is that we can never be sure that we actually do host any given domain. Suppose a

Re: postmulti behind NAT

2013-07-22 Thread Jeroen Geilman
On 07/21/2013 12:23 AM, /dev/rob0 wrote: On Sat, Jul 20, 2013 at 05:18:58PM -0400, Wietse Venema wrote: /dev/rob0: The doubt in my mind about this is for mail truly destined to our hosted domains. It resolves to an Internet (not an internal) IP address which is in the MX instance's proxy_interf

Re: Whitelisting from reverse DNS checks

2013-07-22 Thread Noel Jones
On 7/22/2013 10:21 AM, L.W. van Braam van Vloten wrote: > Hello list, > > Thanks for the info, in a different thread I also saw a reference to > http://postfix.1071664.n5.nabble.com/smtpd-recipient-restrictions-Best-Practices-td10171.html > and it helped me to modify my config. In addition I upgra

Re: Whitelisting from reverse DNS checks

2013-07-22 Thread L.W. van Braam van Vloten
Hello list, Thanks for the info, in a different thread I also saw a reference to http://postfix.1071664.n5.nabble.com/smtpd-recipient-restrictions-Best-Practices-td10171.html and it helped me to modify my config. In addition I upgraded to Postfix 2.9.3 because I want to start using permit_dnswl

Re: Postscreen

2013-07-22 Thread Wietse Venema
Phil Daws: > In the end I followed what somebody else had said with: > > touch /var/lib/postfix/ps_cache > postmap btree:/var/lib/postfix/ps_cache > chown postfix.postfix /var/lib/postfix/ps_cache > service postfix restart For the record, this should not be necessary if redistributors could resis

Re: Postscreen

2013-07-22 Thread Phil Daws
- Original Message - From: "Wietse Venema" To: "Phil Daws" Cc: "Wietse Venema" , postfix-users@postfix.org Sent: Monday, 22 July, 2013 1:19:43 AM Subject: Re: Postscreen Phil Daws: [ Charset UTF-8 unsupported, converting... ] > No reason to reload as it was ALREADY set at that ;) > -