up vote 0 down vote favorite
share [g+] share [fb]

I have PostFix installed and working to send/receive email.

However, my requirement is for this MTA to only receive inbound email from gmail.

The background is that this server runs a product support system and only accepts email sent to support@myhost.com where myhost.com email is hosted by gmail.

So support@myhost.com is configured to forward to the local PostFix MTA that converts the emails into tickets in the product support system.

The PostFix MTA must completely refuse any email from any other IP addresses than gmail MTA servers. And, additionally, if possible, it must only accept incoming email from support@myhost.com

The product support server sits behind a linksys router. So port forwarding on port 25 in the router sends email to the local machine.

Is there a way to reject any communications except from gmail ip addresses?

Or, failing that, can PostFix be configured to only accept connections from gmail ip addresses?

Or, failing that, can PostFix be configured to reject email from any other ip addresses even if it does initially accept the connection?

Essentially we want outsource dealing with spam to gmail. Plus it's simpler to configure and monitor email received to support@tickzoom.com via the gmail website.

Please advise!

link|improve this question
feedback

2 Answers

up vote 0 down vote

I'm confused. You have support emails going to a @gmail.com address which is being forwarded to your local smtp server running your domain, is that correct?

When you send out emails surely you will be sending them with addresses @yourdomain which people will try replying to, and you want to bounce those emails if the person isn't a Gmail user? That seems a really bad idea. If you want to outsource your spam handling then you could either use Google Apps for the domain and have Google host all your email, or you could use one of the spam filtering services that sit between you and your domain.

Given you have a Linksys router I'm guessing you're running on an ADSL connection which probably isn't designed to be running a mail server off of. I would seriously consider having Google host your email to keep everything simple and not have to worry about managing servers or internet connections locally.

link|improve this answer
Thanks for asking. No, the support emails go to support@yourdomain.com but gmail offers a business service to host yourdomain on their servers. So the support@yourdomain.com is really a gmail account. And we test it to forward to the product support server which has a totally unrelated non-public domain name. The product support system is Redmine which is far more than a mail server. It allows organizing tickets based on priority, bug vs. defect, assigning to specific or multiple people, etc. for project management. So it must be the destination of the emails. – Wayne Jun 20 '10 at 22:34
The point is the Redmine software can run on a server and receive and send emails directly to the rest of the world. Problem is, (have you every run a public email MTA?) a public MTA like that gets bombarded with spam emails. And the Redmine we want configured to automatically create an account and accept an email to create a support ticket for any new unknown users for their convenience. So it would be a nightmare filtering out all the spam, blacklisting IPs, etc. Furthermore, a private unknown MTA requires constant work and maintenance to make sure it's not getting black listed. – Wayne Jun 20 '10 at 22:38
So our product support MTA connects to the support@mydomain.com on the gmail SMTP server using TLS to relay mail out from gmail. That way, all the outgoing mail comes from gmail servers that never get blacklisted anywhere. And, of course, gmail has an entire department devoted to managing and eliminating spam which is highly effective with few, if any, false positives. – Wayne Jun 20 '10 at 22:39
One last fact. This is a temporary configuration built in a virtual machine on VMWare Workstation. After it's configured and tested a few weeks. We'll move the virtual machine to a Data Center rather than sitting behind this ADSL line. – Wayne Jun 20 '10 at 22:48
OK in that case have you considered just polling Google's IMAP servers rather than receiving by smtp? Assuming it's just one or two gmail accounts that is. – kaerast Jun 21 '10 at 8:33
show 1 more comment
feedback
up vote 0 down vote accepted

Ohhh, yeah! We have a sweet solution now.

We have added all of Gmails outbound servers to the firewall and only allow them to talk to port 25 on our server. Nobody else.

It works great.

FYI, Google publishes an SPF record with all their valid outbound servers according to the RFC.

So I simply added them all into the firewall for port 25 -- SMTP.

There's only one flaw in this plan.

What if Google adds or changes the SPF list?

Later on, I will make a cron job that once per day, does an SPF lookup, parses the host list, and updates the firewall restriction list.

Then it will be fool proof. Any spammers will only see a closed port, so it will get scratched off their list as a vulnerability. We won't even have the server bogged down with filtering email and such.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.