Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a scenario where I need to setup postfix with no TLS, no SMTP authentication, and open relay allowing from only one remote IP address. Emails from this remote IP may have spoofed "from" address as well.

I know, dont ask about how I got to this point...

My concern is that my server will be blacklisted in the future.

What are the best practices for managing open relay server so that it will not be blacklisted??

Thanks in advance.

share|improve this question
add comment

5 Answers 5

up vote 8 down vote accepted

It's not an open relay if you are merely accepting any mail from a single IP address. (Open relays accept any mail from anywhere.)

In this case, simply add the IP address to mynetworks in your Postfix main.cf.

Oh, and don't send spam.

share|improve this answer
    
And, if you're extra paranoid, configure netfilter to only accept connections to 25/tcp from that single IP. –  EEAA Dec 27 '12 at 18:47
add comment

Don't make it an "open relay"... Just don't require authentication from that one IP address to relay. It's really not the same thing. I do this all the time for internal IP ranges (eg my internal Printer range doesn't need to authenticate, so they can send e-mail notifications without user accounts that would need to be constantly maintained).

share|improve this answer
add comment

The best practice for open relay email servers is not to have one, and blacklist any you find.

share|improve this answer
add comment

SMTP best practices and open relays are mutually exclusive.

RFC5068: http://tools.ietf.org/html/rfc5068

share|improve this answer
add comment

As long as it's only one remote ip, your simplest solution would be to firewall off the traffic except for that one machine.

Something like:

-A <chain> -s <your_ip>/32 -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A <chain> -m tcp -p tcp --dport 25 -j DROP

Also, like others have said, you really shouldn't be running an open relay.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.