0

I am running exim4 on a vanilla Debian Stable system. The machine has proper DNS A and MX records. I want to use it as a mail server.

SMTP with TLS already works fine for authenticated users.

However I can still telnet from somewhere else to the server using smtp and send mails to my own domain by spoofing the MAIL FROM and picking the right RCPT TO.

How can I configure exim so that only real mail hosts with MX record can use unauthenticated SMTP?

3
  • This sounds like a really bad idea, especially for mail from domains where the MX record points to an outsourced spam filter server (or even just a spam "firewall" appliance server), and some other server handles outgoing mail. Or all mail from Gmail.
    – DerfK
    Nov 4, 2014 at 0:36
  • DerfK: can you elaborate on that? How else would you reject mails from spammers that use your own email addresses as from and rcpt?
    – Arne
    Nov 4, 2014 at 6:23
  • Blocking mail forged from your own domain is one thing. The assumption that "real mail hosts" are always in the MX server list is wrong.
    – DerfK
    Nov 4, 2014 at 14:22

1 Answer 1

0

I found an answer on askubuntu which sort of makes my configuration better. It changes the default warning on failed RDNS lookup to an error. Debian usually only warns on a failed reverse DNS lookup, if CHECK_RCPT_REVERSE_DNS is set. However, this piece of configuration will change that to an error:

# Verify reverse DNS lookup of the sender's host.
deny
  message Reverse DNS verification failed
  !verify = reverse_host_lookup
  !hosts = ${if exists{CONFDIR/local_broken_dns_whitelist}\
                      {CONFDIR/local_broken_dns_whitelist} {}}

It seems what I want in the end is forward confirmed reverse DNS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .