1

I'm running postfix 3.1 and I just got some email from 183.8.202.206 that said it came from gmail. A quick lookup shows that unless Google has been sold to ChinaNet, that's probably a lie.

Most of the spam that I get comes from a mismatched IP and domain name - is there a way to configure postfix to say something like, "Only accept email from gmail/yahoo/outlook/hotmail addresses if it comes from these IP addresses"?

I've read the postfix docs time and time again, but I don't recall seeing that as a possibility.

2 Answers 2

3

This is the problem that SPF solves, and you can integrate it into Postfix with one of two SPF validating daemons for Postfix. The Python version is probably the best choice.

The installation will vary a bit depending on your Linux distribution, but in general you'll do what's in Ubuntu's tutorial:

In /etc/postfix/main.cf you will need to add the following line (it doesn't matter where, usually they get added to the end.

policy-spf_time_limit = 3600s

This changed the ups the policy time limit so the policy server won't time out while a message is still being processed.

Add this section to /etc/postfix/master.cf for the Python script

policy-spf  unix  -       n       n       -       -       spawn
     user=nobody argv=/usr/bin/policyd-spf

or for the Perl script policy-spf unix - n n - - spawn user=nobody argv=/usr/sbin/postfix-policyd-spf-perl

Finally, you need to add the policy service to your smtpd_recipient_restrictions in file /etc/postfix/main.cf:

smtpd_recipient_restrictions =
     ...
     permit_sasl_authenticated
     permit_mynetworks
     reject_unauth_destination
     check_policy_service unix:private/policy-spf
     ...

Note: Put the policy service after reject_unauth_destination to prevent unexpected responses from the policy service from making your system an open relay (this is recommended for all policy services). Moreover, put the policy service after you permit local senders. You only want SPF to check inbound mail from the internet, not outbound mail from your users.

2
  • Do I have to configure anything or is it all magic? I don't really see anything in that guide that mentions how to configure it :| Mar 28, 2017 at 21:00
  • There's really nothing else to configure. Mar 28, 2017 at 21:08
0

Edit main.cf and find section

smtp_sender_restrictions

Add this

reject_unknown_hostname

Actualy this section has many options

And in case of proper configuration your postfix you can read this article

http://www.postfix.org/ADDRESS_VERIFICATION_README.html

Best Regards!

4
  • recipient restrictions though? Shouldn't it be a sender/client restriction? I do have check_client_access and $blacklist where I've been adding garbage IPs as they come in, but that's more like swatting at flies :P Mar 28, 2017 at 21:02
  • This is a good thing to do to prevent spam, but it doesn't do anything to help with the problem in the question. Mar 28, 2017 at 21:11
  • Yeah your right, bad copy\paste=)
    – Mgr
    Mar 28, 2017 at 21:17
  • @MichaelHampton Oh we can talk about spam for hours and days, actualy if you need anti spam, you can use spamassasin or any other anti spam. Also you need proper configured DKIM SPF DMARC and first that you need to do is configure your restriction. Because it's beter to block spam on postfix layer, it's faster and beter in performance.
    – Mgr
    Mar 28, 2017 at 21:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .