Re: accept+discard vs. reject

2017-07-25 Thread /dev/rob0
On Tue, Jul 25, 2017 at 09:02:17PM -0400, Kevin A. McGrail wrote: > On 7/25/2017 8:48 PM, /dev/rob0 wrote: > >I am curious, what kind of logic do you have to determine that a > >spamming client might be a backscatterer? Are you talking about a > >custom policy service, or a milter? > > For the re

Re: accept+discard vs. reject

2017-07-25 Thread Kevin A. McGrail
On 7/25/2017 8:48 PM, /dev/rob0 wrote: I am curious, what kind of logic do you have to determine that a spamming client might be a backscatterer? Are you talking about a custom policy service, or a milter? For the record, I can agree to disagree as I respect and understand your position. I j

Using two content filter

2017-07-25 Thread Luis Miguel Flores dos Santos
Hi, today I have a policyd configured in my postfix server like: MAIN.CF smtpd_sender_restrictions = check_policy_service inet:127.0.0.1:10031 reject_sender_login_mismatch smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10031 Today I need a content filter to modify my messag

accept+discard vs. reject (was: Re: What's a better error code ...)

2017-07-25 Thread /dev/rob0
On Tue, Jul 25, 2017 at 07:49:32PM -0400, Kevin A. McGrail wrote: > On 7/25/2017 7:42 PM, /dev/rob0 wrote: >> On Tue, Jul 25, 2017 at 07:07:18PM -0400, Kevin A. McGrail wrote: >>> Unfortunately, you might need logic to accept and silently >>> discard. We do this, for example, with viruses to avoi

Re: What's a better error code than 554 to get a sending server to stop retrying?

2017-07-25 Thread Kevin A. McGrail
On 7/25/2017 7:42 PM, /dev/rob0 wrote: Oh, I disagree. The best thing to do is to reject anything you're unwilling/unable to deliver. You're not causing any bounces; if a connecting client does generate a bounce for your rejection that is THEIR problem; or in the case of a human sender, that is

Re: What's a better error code than 554 to get a sending server to stop retrying?

2017-07-25 Thread /dev/rob0
> On 7/25/2017 5:51 PM, robg...@nospammail.net wrote: > >Depending on where I read about it that "554 5.7.1" error code > >means "failed transaction". 554 is described in RFC 5321, yes, as "failed transaction". 5.7.1 is an Extended Mail System Status Code, described in RFC 3463: https://tools.i

Re: What's a better error code than 554 to get a sending server to stop retrying?

2017-07-25 Thread Kevin A. McGrail
On 7/25/2017 5:51 PM, robg...@nospammail.net wrote: Depending on where I read about it that "554 5.7.1" error code means "failed transaction". Unfortunately, you might need logic to accept and silently discard. We do this, for example, with viruses to avoid blowback. Regards, KAM

Re: What's a better error code than 554 to get a sending server to stop retrying?

2017-07-25 Thread Wietse Venema
robg...@nospammail.net: > But they keep retrying to resend the email that's getting REJECTed. > Every 15mins for the past 9+ hours since the 1st message was sent > and got rejected. RFC 5321, the definition of SMTP says: 4.2.1. Reply Code Severities and Theory ... 5yz Permanent Negative Comp

What's a better error code than 554 to get a sending server to stop retrying?

2017-07-25 Thread robgane
I have a milter set up to REJECT on some body content. It works like it should and REJECTS with the message Jul 25 14:41:13 mariner postfix/handoff/smtpd[56542]: proxy-reject: END-OF-MESSAGE: 554 5.7.1 id=12969-07 - Rejected by next-hop MTA on relaying, from MTA(smtp:[127.0.0.1]:16002):

Re: Enforce TLS to MX

2017-07-25 Thread Viktor Dukhovni
> On Jul 25, 2017, at 3:59 AM, post...@xmas.de wrote: > > We have partners who have numerous domains and don't wan't to tell me > the whole list of domains. Postfix TLS security is by destination domain. Basing TLS security policy on the insecurely obtained MX host is futile. If there's no man

Re: Enforce TLS to MX

2017-07-25 Thread Bastian Blank
On Tue, Jul 25, 2017 at 09:59:43AM +0200, post...@xmas.de wrote: > I only have the MX and have to ensure that the transport is encrypted. Well. If the remote system announces STARTTLS, it will be used. So you ensured to use encryption if the remote system tells you it works. > I understand that

Re: Enforce TLS to MX

2017-07-25 Thread postfix
Zitat von Viktor Dukhovni : On Mon, Jul 24, 2017 at 01:53:57PM -0400, Wietse Venema wrote: post...@xmas.de: > Hi, > > isn't it possible to enforce TLS outbound to an MX ? Sure there is. /etc/postfix/master.cf smtp-encrypt .. .. .. .. .. .. smtp -o smtp_tls_security_level=encrypt /etc/po