8

It would be nice to reject incoming emails which use one of my virtual domains as sender address while not being a legitimate user of mine.

I know that I can reject incoming emails which use an existing alias/account name using smtpd_sender_restrictions=reject_sender_login_mismatch, this does however still allow attackers to use a non-existant emailaddress with one of my virtual domains. (Which is favored in regards to spam detection).

What's the best way to reject incoming mails which use one of my virtual domains and aren't authenticated to do so?

SPF as well as DKIM are set up but configured to SoftFail, due to problems with mailinglists and forwards. I am not looking for SPF or DKIM but a solution for the postfix server that is the MX of the aforementioned domains.

Improve this question
11
  • Using reject_sender_login_mismatch and reject_unlisted_sender?
    – masegaloeh
    May 6, 2015 at 8:20
  • Try using smtpd_sender_restrictions, first permit_mynetwork and permit_sasl_authenticated, then use a pcre:/etc/postfix/sender_access file where you can try /@my\.domain$/ REJECT
    – Dan
    May 6, 2015 at 8:33
  • @Dan look at the second method I listed, it is very similar to what you suggested.
    – Zulakis
    May 6, 2015 at 9:00
  • @masegaloeh Can you explain? man postconf wasn't really clear on what reject_unlisted_sender does, it seemed to me that it does reject ALL unknown senders? (postfix.org/postconf.5.html#reject_unlisted_sender) Maybe it's a better way to do it than what I did.
    – Zulakis
    May 6, 2015 at 9:00
  • 1
    Nope. postfix only reject if (1) sender domain in virtual_mailbox_domains and (2) sender address doesn't listed in virtual_mailbox_maps and so on. See postfix.org/postconf.5.html#smtpd_reject_unlisted_sender
    – masegaloeh
    May 6, 2015 at 9:25

5 Answers 5

Reset to default
10

I found two possible methods, but maybe there is a better way.

1st method:

smtpd_sender_restrictions =
    reject_sender_login_mismatch,
    permit_sasl_authenticated,
    permit

Now I modified my smtpd_sender_login_maps to return an entry of admin if the domain exists in the domains table. This way a record is returned, even when the emailadress doesn't exist as maibox/alias, but not when a foreign domain is the from address.

table = domain
query = SELECT username AS allowedUser FROM mailbox WHERE username="%s" AND deleted_at IS NULL \
UNION SELECT goto FROM alias WHERE address="%s" AND active = 1 \
UNION select 'admin' from domain where domain = '%d'

2nd method:

This approach uses a check_sender_access lookup which returns a reject action if the domain is a virtual one and the user is not sasl_authenticated.

smtpd_sender_restrictions =
    reject_sender_login_mismatch,
    permit_sasl_authenticated,
    check_sender_access proxy:mysql:$config_directory/mysql_reject_virtual_domains.cf,
    permit

mysql_reject_virtual_domains.cf:

table = domain
query = select 'Reject 530 SMTP authentication is required' from domain where domain = '%d'

3rd method (thanks to masegaloeh):

smtpd_sender_restrictions =
    reject_sender_login_mismatch,
    permit_sasl_authenticated
    reject_unlisted_sender,
    permit

I don't know how many cpu-load/SQL-queries reject_unlisted_sender generates, as it checks quite many things:

Request that the Postfix SMTP server rejects mail from unknown sender addresses, even when no explicit reject_unlisted_sender access restriction is specified. This can slow down an explosion of forged mail from worms or viruses.

An address is always considered "known" when it matches a virtual(5) alias or a canonical(5) mapping.

  • The sender domain matches $mydestination, $inet_interfaces or $proxy_interfaces, but the sender is not listed in $local_recipient_maps, and $local_recipient_maps is not null.
  • The sender domain matches $virtual_alias_domains but the sender is not listed in $virtual_alias_maps.
  • The sender domain matches $virtual_mailbox_domains but the sender is not listed in $virtual_mailbox_maps, and $virtual_mailbox_maps is not null.
  • The sender domain matches $relay_domains but the sender is not listed in $relay_recipient_maps, and $relay_recipient_maps is not null.
Improve this answer
0
1

The righteous way is to setup SPF for your domain and enable SPF in the MTA. Then you'll get protection not only for your own domain forging but also for all other domains having SPF enabled.

Improve this answer
1
  • 3
    Please have a look at my note regarding SPF/DKIM in the question.
    – Zulakis
    May 5, 2015 at 15:03
1

You should try to implement at least one of the followings (both is better):

Improve this answer
3
  • 3
    Please have a look at my note regarding SPF/DKIM in the question.
    – Zulakis
    May 5, 2015 at 15:03
  • softfail that's like it's not even enabled, you should look into enforcing it.
    – alexus
    May 5, 2015 at 15:08
  • 2
    @alexus The SPF evaluation might still be relevant for spam detection after the message has been accepted, like spamassin does. The point is, that SPF should be enforced only for the own domain when the messages didn't arrive on the system an can be still rejected.
    – sebix
    May 5, 2015 at 15:11
1

Yet another 1st method with separate query without unions:

virtual_sender_mailbox_maps.cf

query = SELECT '%s' AS email FROM domains WHERE name='%d' AND active=TRUE

main.cf

smtpd_sender_login_maps = ${proxysql}virtual_sender_mailbox_maps.cf
smtpd_sender_restrictions =
    reject_sender_login_mismatch,
    permit_sasl_authenticated,
    permit
Improve this answer
0

The setup described here worked best for me:

https://superuser.com/a/1148938/66217

  1. Configure port 587 for authenticated submission.

  2. Create /etc/postfix/access containing:

mydomain.com REJECT
  1. Add check_sender_access hash:/etc/postfix/access to smtpd_sender_restrictions.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .