I'm looking for a bit of advice on Postfix restrictions configuration. I'm looking for a balanced configuration which properly rejects spam and unauthorized access retries.
Lately, I've been reading some docs and trying to learn from other's experience, but I'm a bit confused when restrictions come about. Right now I'm being forced to set permit_sasl_authenticated
as first restriction so authenticated users does not match against spam blocking lists while sending email from their desktop email client application. If I remove such restriction then people send email through desktop email client applications such as MS Outlook and which are connected to the net through ADSL or behind a dynamic IPs, usually is detected as spam.
I'm wondering if I have missed anything as when reading others configuration, tutorials and docs they look like not suffering from that issue. I feel like I'm the only one.
I'm also wondering if I'm checking against the right spam lists at each restriction statement.
mynetworks_style = host smtpd_client_restrictions = permit_sasl_authenticated, reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl ,reject_rbl_client zen.spamhaus.org ,reject_rbl_client bl.spamcop.net ,check_client_access regexp:/etc/postfix/client_restrictions smtpd_data_restrictions = reject_unauth_pipelining smtpd_end_of_data_restrictions = smtpd_etrn_restrictions = smtpd_helo_restrictions = permit_mynetworks, check_helo_access hash:/etc/postfix/helo_access, permit_sasl_authenticated, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_pipelining, permit_mynetworks, reject_non_fqdn_recipient, warn_if_reject reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, warn_if_reject reject_unknown_helo_hostname, check_policy_service inet:127.0.0.1:10023, check_policy_service unix:private/policy-spf, permit smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination smtpd_restriction_classes = smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit
One issue I faced was bl.sorbs.net
detecting some Microsoft IPs as spam.
Any kind of tips and advice are welcome.