In the daily battle against SPAM, there have been several times when I've been tempted to heavily enforce DNS requirements from clients connecting from the wild Internet.
In detail, I would have added the reject_unknown_reverse_client_hostname setting within my smtpd_client_restrictions section, as in:
smtpd_client_restrictions =
permit_sasl_authenticated
check_client_access hash:/etc/postfix/access
check_policy_service inet:127.0.0.1:4466
reject_unknown_reverse_client_hostname
reject_unauth_pipelining
Anyway, I noted that when hitting such restriction, Postfix behaviour is quite "soft" as the default value for the unknown_client_reject_code
is 450. Hence, client is invited to keep retrying.
While investigating for a 550 response, I met following statement, on the official Postfix documentation:
I'm absolutely not an expert about the whole RFC 5321, but as someone old enough to know RFC 821, I really don't see why, a 550 response instead of a 450, could impact my Postfix instance at the maximum SMTP level (breaking RFC compliance), expecially considering that in case of temporary errors, Postfix will stick with a 450 regardless of the explicit setting.
So, can someone help me understanding what's the problem with such a replacement?
P.S.: in the meantime, I ended with a "relaxed" restriction:
smtpd_client_restrictions =
permit_sasl_authenticated
check_client_access hash:/etc/postfix/access
check_policy_service inet:127.0.0.1:4466
warn_if_reject reject_unknown_reverse_client_hostname
reject_non_fqdn_helo_hostname
reject_unauth_pipelining
reject_invalid_helo_hostname