5

I have configured postfix like this to prevent spam (I am mydomain.com):

smtpd_helo_restrictions         =
    permit_mynetworks
    permit_sasl_authenticated
    check_client_access hash:/etc/postfix/check_client_access
    check_helo_access hash:/etc/postfix/check_helo_access
    reject_non_fqdn_helo_hostname
    reject_invalid_helo_hostname
    reject_unknown_helo_hostname
...

Because of that, I have the following logs:

Jul 30 00:04:14 stormrage postfix/smtpd[28116]: NOQUEUE: reject: RCPT from srv-exchange.anett.fr[80.118.5.170]: 450 4.7.1 <emailsecurity.domain.com>: Helo command rejected: Host not found; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<emailsecurity.domain.com>

This example log is a legitimate email, so I whitelist in check_helo_access like this:

/etc/postfix/check_helo_access:
emailsecurity.domain.com OK
...

It works, but I think the whitelisting may be strengthen. I can whitelist by host or by sender, but not both.

How can I whitelist an email based on specific sender/domain-sender when sent though specific host ?

3
  • I agree but I'm not sure this is doable. However, using your configuration plus some regular antispam should lead to pretty good results.
    – user130370
    Jul 31, 2013 at 9:40
  • Yes and furthurmore this part of the conf is useless against spam received from hacked/fake account (from gmail or microsoft live), but this is for personal and small business use, so I can accept to manually fix false positive (for now).
    – Veovis
    Jul 31, 2013 at 13:35
  • I don't understand your sentence: 'It works, but I think the whitelisting may be strengthen.' What do you mean by that? Sep 18, 2019 at 18:34

1 Answer 1

4

I can whitelist by host or by sender, but not both.

actually you could. All you need is to use smtpd_restriction_classes

smtpd_restriction_classes = sender_white_list
sender_white_list = check_client_access hash:/etc/postfix/check_client_access, reject

smtpd_helo_restrictions =
  check_helo_access hash:/etc/postfix/check_helo_access
  permit_mynetworks
  permit_sasl_authenticated

/etc/postfix/check_helo_access
emailsecurity.domain.com sender_white_list

/etc/postfix/check_client_access
80.118.5.170 OK
2
  • smtpd_restriction_classes is not practical however.
    – Veovis
    Jul 31, 2013 at 13:13
  • Unfortunately, as I know, there is no other way to get such behavior in the postfix. If you need more flexible rules you could try to write you own policy service as described at postfix.org/SMTPD_POLICY_README.html
    – ALex_hha
    Jul 31, 2013 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .