I have an MS Exchange 2003 configured as a mail server for an organization. As this server is located in this organization internal network and I don't want to expose it directly over internet, I have second server - linux box with sendmail - configured as intelligent relay (it accept all messages from internet addressed to @my_domain, and forward it to internal Exchange serwer, and accepts all messages from this internal Exchange server and forward it over internet). This configuration work's fine, but I want to eliminate messages addressed to not exiting users as early as possible.

Good solution could be Enabling on Exchange server function of filtering recipients together with "tar pitting", but in my case this dosn't solve problem, because before any message reach my Exchange server (which could eventually reject it), it has to be already accepted by sendmail server, sitting in front of this Exchange server.

So, I want to configure my sendmail server in such a way, that during initial SMTP conversation it could query somehow my Exchange server checking whether recipient address is valid or not, and based on result of this query, accept or reject (possibly with some delay) incoming message in a very early phase.

In fact, I have already solved this issue by writing my own, simple sendmail milter program which checks recipient address against text file with list of valid addresses. But this solution is not satisfying me any longer, because it requires frequent updates of this file, and due to lack of time/motivation/programming skills, I don't want to cope further with my source code, adding to it functionality of querying my Exchange server.

Maybe I can achieve desired effect by configuring any component of already available linux software.

Any ideas?


You can keep your list up to date by querying Exchange (&(|(objectClass=group)(objectClass=user))(email=*)

through ldapsearch, or configure sendmail to lookup the incoming user through LDAP

define(confLDAP_DEFAULT_SPEC',-p 389 -h ldap.foobar.com' -b dc=foo,dc=bar'')dnl define(ALIAS_FILE',/etc/aliases,ldap:-k (&(|(objectclass=user)(objectclass=group))(proxyAddresses=smtp:%0)) -v mail')dnl

You'll need to adjust the LDAP_DEFAULT_SPEC line with appropriate parameters to search the proper OUs in your AD setup.

Caveats are the usual ones about what happens when your LDAP query fails (exchange / network is down) or is slow.

| improve this answer | |
  • Yes, initially I updated my list file using ldapsearch, but soon size of full list of all recipients become larger then the default size of LDAP message, so I have to revert to manual updates. I will try to use your suggested changes to sendmail.mc, but doesn't it mean, than with every query (that is with every message) I will be rebuilding my aliases file? Could you point me to some source explaining in more detail mechanics of your solution? Nevertheless, Thank you for your help. – user71061 Feb 28 '11 at 18:13
  • To Graham Dunn: I have applied your suggestions, but its don't work as I expect. If sender use address of not existing user, then message did not reach my Exchange server, but is still accepted by sendmail server, which generates and send to sender NDR (non delivery report). Instead sendmail server should return to sender code 550 and don't proceed to accept message body. – user71061 Mar 1 '11 at 11:41
  • Update: I'm sorry, but after checking it toughly it appears, that my sendmail server doesn't query Exchange server at all!. It simply accept any message to what_ever_user@my_domain and then attempt to relay it to exchange server. If used recipient doesn't exist on exchange server, then conversation with sendmail server is immediately canceled (with code 550), and sendmail server is then in charge of sending NDR. So my question remains still open ... – user71061 Mar 1 '11 at 14:33

Ok, finaly I manage to get it working. My changes to sendmail.mc was as follows:

FEATURE(`ldap_routing',, `ldap -1 -T<TMPF> -v mail -k proxyAddresses=SMTP:%0', `bounce')dnl
define(`confLDAP_DEFAULT_SPEC', `-p 389 -h "my_ldap_server.my.domain.com" -d "CN=sendmail_user,CN=Users,DC=my,DC=domain,DC=com" -M simple -P /etc/mail/ldap-password -b "DC=my,DC=domain,DC=com"')dnl 

I required to create in Active Directory an user named "sendmail_user" and put it's password in ldap-password file.

But still I don't know how to delay server response in case of using invalid recipient address (to mitigate any spamer scanning for posibble user names).

Any sugestions?

| improve this answer | |

I am using MIMEDefang's md_check_against_smtp_server(). milter-ahead is another option

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.