1

I have a postfix server runing from about 8 month,

The server reject emails when EHLO point to a domain like "xxxx.local"

My question is: Is correct that an smtp server identify itself as "something.local"?

If yes, the Postfix reject_unknown_helo_hostname configuration is wrong? How to handle these mails from "something.local"?

Out: 220 example.org ESMTP Postfix
 In:  EHLO xxxxxx.local
 Out: 250-example.org
 Out: 250-PIPELINING
 Out: 250-SIZE 104857600
 Out: 250-VRFY
 Out: 250-ETRN
 Out: 250-STARTTLS
 Out: 250-ENHANCEDSTATUSCODES
 Out: 250-8BITMIME
 Out: 250 DSN
 In:  MAIL FROM:<[email protected]> SIZE=12193
 Out: 250 2.1.0 Ok
 In:  RCPT TO:<[email protected]>
 Out: 450 4.7.1 <xxxxxx.local>: Helo command rejected: Host not
     found
 In:  QUIT
 Out: 221 2.0.0 Bye

3 Answers 3

6

It's not wrong but it's too restrictive. This restriction rejects the request when the HELO or EHLO hostname has no DNS A or MX record.

To make it weaker, you can try to use restrictions

reject_unknown_reverse_client_hostname

which rejects the request when the client IP address has no address->name mapping and

reject_invalid_helo_hostname

which rejects the request when the HELO or EHLO hostname syntax is invalid.

Additionally, you can change the behaviour of a restriction to log warnings instead of rejecting a request

warn_if_reject reject_unknown_helo_hostname

Please check postconf(5) man page for detailed description of these restrictions.

2

You should allow invalid FQDNs in the HELO on port 587 only (the submission port).

That was the point of separating the submission port from port 25 (see RFC 6409). Just make sure nobody can submit mail to port 587 without authenticating with SMTP AUTH first.

1

It is definatly not correct that a mail server identifies itself as something.local. Email requires that each server presents a valid fqdn. It is a usefull spam prevention mechanism to require proper dns settings from your peers. That said, there are other reasons to allow faulty dns settings, like local machines with configurations out of your scope.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .