Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have small problem with my sendmail server and need your little help :-)

My situation is as follow:

User mailboxes are placed on MS exchanege server and all mail to and from outside world are relayed trough my sendmail box.

Exchange server ----- sendmail server ------ Internet

My servers accept messages for one main domain (say, and for few other domains (let we narrow it too just one, say After configuring sendmail with showed bellow abbreviated file, essentially everything works ok, but there is small problem. I want to reject messages addressed to not existing recipients as soon as possible (to avoid sending non delivery reports), so my sendmail server make LDAP queries to exchange server, validating every recipient address. This works well both domains but not for subdomains. Such subdomains do not exist, but someone (I'm mean those heated spamers :-) could try addresses like this: 


and for those addresses results are as follows:

  1. Messages to are rejected with error "Unknown user" (due to additional LDAPROUTE_DOMAIN line in my file, and this is expected behaviour)
  2. Messages to are rejected with error "Relaying denied". Little strange to me, why this time the error is different, but still ok. After all message was rejected and I don't care very much what error code will be returned to sender (spamer).
  3. Messages to and are rejected with error "Unknown user" but only when, there is no mailbox (on exchange server). If such mailbox exist, then all three addresses (i.e., and will be accepted. (adding additional line LDAPROUTE_DOMAIN( to my file don't change anything)

My abbreviated file is as follows (sendmail 8.14.3-5). Both domains are listed in /etc/mail/local-host-names file (FEATURE(use_cw_file) ):


FEATURE(`access_db', , `skip')dnl

dnl define(`confLDAP_DEFAULT_SPEC',`-p 389 -h -b dc=my,dc=domain,dc=com')dnl 
dnl define(`ALIAS_FILE',`/etc/aliases,ldap:-k (&(|(objectclass=user)(objectclass=group))(proxyAddresses=smtp:%0)) -v mail')dnl

FEATURE(`ldap_routing',, `ldap -1 -T<TMPF> -v mail -k proxyAddresses=SMTP:%0', `bounce')dnl
define(`confLDAP_DEFAULT_SPEC', `-p 389 -h "" -d "CN=sendmail,CN=Users,DC=my,DC=domain,DC=com" -M simple -P /etc/mail/ldap-secret -b "DC=my,DC=domain,DC=com"')dnl



Could someone more experienced with sendmail advice my how to reject messages to those unwanted subdomains?

P.S. Mailboxes are used only for receiving messages and never for sending.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

In the configuration README you will see that using MAIL_HUB redirects all incoming mail to a centralized hub. Since you have LDAP routing comment out the MAIL_HUB entry.

share|improve this answer
I have tried removing MAIL_HUB directive, but then all messages addressed to are rejected with error "User unknown". I think that I need right combination of MAIL_HUB, stickyhost and LOCAL_RELAY, but could not figure it out. – user71061 Mar 15 '11 at 10:04
Is equivalent to ? – adamo Mar 15 '11 at 10:45
Sometimes. Every has also address, but the opposite is not always true. – user71061 Mar 15 '11 at 10:53
First of all, you do not need MAIL_HUB. Now let us concentrate on the "User unknown" error for users. What happens when you query the Exchange server via LDAP from the sendmail host for those users from the command line? – adamo Mar 15 '11 at 14:23
I'm sorry but I could not construct valid ldapsearch command (it has different option letters from ldap client build into sendmail). Could you show me how should I do this? (I have already tried: ldapsearch -p 389 -h my_exchange_host -D "CN=user_name,CN=Users,DC=my,DC=domain,DC=com" -y /etc/mail/ldap-secret -b "DC=my,DC=domain,DC=com" -v mail "(&(|(objectclass=user)(objectclass=group))(‌​" , but receive error: "ldap_sasl_interactive_bind_s: Unknown authentication method (-6)". I'm Sorry, but I completely don't understand LDAP. – user71061 Mar 15 '11 at 15:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.