Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

SMTP clients are required to pass user authentication before sending emails to other domains (relay). And we can use smtpd_sender_restrictions to make sure the MAIL FROM address matches the authenticated user. But how to make sure the From address in the mail header matches the MAIL FROM address? We also want to limit Reply-To header, so spam senders can hardly use our SMTP server, even if they break some of the user passwords.

share|improve this question
    
Are you meaning to do this only for authenticated users? There are many cases where it's impossible to enforce that the envelope sender matches the From: line. It may be that by enforcing this restriction only for authenticated users, that you can get away with this, though. (This is speaking from a practicality of use standpoint--not an implementation standpoint) –  Flimzy Jul 1 '11 at 8:56
    
Yes only for authenticated users, because only authenticated users can use the SMTP server as a relay. –  Gary Shi Jul 1 '11 at 9:20
    
Aside from the annoyance to your legitimate users from that Reply-To: restriction, don't forget what RFC 5322 section 3.6.2 actually allows for originator headers. –  JdeBP Jul 1 '11 at 9:27
    
Yes, limiting Reply-To only applies to organization's specific IT policy. –  Gary Shi Jul 1 '11 at 10:15

2 Answers 2

The From: and To: (and other) lines in the message header don't have a meaning for mail delivery. Only the envelope addresses matter (MAIL FROM and RCPT TO). So while enforcing the MAIL FROM sender matches the SASL authenticated user you have done everything possible to prevent misuse of an account. Standard mail clients and even spambots ensure by themselves that the From: and MAIL FROM are equal. But if you really want to ensure From: and MAIL FROM then you have to apply header_checks so that Return-Path: matches From:

share|improve this answer
    
Interesting, but hard to confirm. I'd like to have a try, but how to ensure the matching in header_checks? –  Gary Shi Jul 24 '11 at 0:30

If You want to do re-write mail headers, you'll have to have postfix pass the mail through some program which does the re-writing. Have a look at documentation for something like policyd for how that interaction works.

However, I'm not convinced that what you're describing is a good idea, or helpful with spam. If you can't rely on the behaviour of authenticated users, then you need to do content filtering much as you'd do for mail coming in for mail from unknown sources coming to your users.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.