0

I want to use a Postfix box to do two things:

  • Relay mail from any host on the internet addressed to one of my domains to my Zimbra server
  • Relay mail from my Zimbra server to any address on the internet.

To try and accomplish this I have configured Postfix thusly:

mynetworks = 127.0.0.0/8, zimbra_ip/32
myorigin = zimbra_server
mydestination = localhost, zimbra_server
relay_domains = example.com example.org
transport_maps = hash:/etc/postfix/transport_map
local_transport = error:no mailboxes on this host

transport_map looks like this:

example.com smtp:[zimbra_server]
example.org smtp:[zimbra_server]

Now, this works and passes the Open Relay tests. However, I am seeing in the maillog that the server is relaying spam that has a From: address of <> to domains that are not mine. How do I stop this behavior?

1 Answer 1

1

You need to put in smtpd_recipient_restrictions for some in-bound header checking. There are tones of example on the web, following is an example for relay only host

smtpd_helo_restrictions =
    permit_mynetworks,
    reject_non_fqdn_hostname,
    reject_invalid_hostname,
    permit

smtpd_recipient_restrictions =
    permit_mynetworks
    reject_invalid_hostname
    reject_non_fqdn_hostname
    reject_non_fqdn_sender
    reject_non_fqdn_recipient
    reject_unauth_destination
    reject_unknown_sender_domain
    reject_unknown_recipient_domain
    reject_rbl_client bl.spamcop.net
    permit

reject_unauth_destination should reject email to domains that are not yours.

reject_non_fqdn_sender should reject (some) email with improper From field.

You may want to remove reject_invalid_hostname from both of them if you get too many false positive.

reject_rbl_client is another one you should research into. I give you one in the example. You can add more.

That should give you a starting point. Those option names should be self-explanatory. Detail information can be found on postfix site.

You may even add spam filtering and virus scanner like amavis. Again there are lots of example if you do some search.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .