0

we have an Mdaemon server which redirects outbound mails to an external basic Postfix relayer. We have configured firewall rules (in front of postfix server) to accept smtp requests only from the public IP of the Mdaemon primary mail server. We also has configured this IP in main.cf mynetworks parameters.

mynetworks = 127.0.0.0/8 <public IP Mdaemon SVR>/32

We noticed that we were receiving mails with From=anyuser@anydomain bounced from the primary mail server and want to accept only requests with FROM=users@mydomain and reject the rest. We have read about it and the simplier way seems to be using smtpd_recipient_restrictions so we did,

  1. At main.cf added

    smtpd_recipient_restrictions = permit_mynetworks, check_sender_access hash:/etc/postfix/sender_access reject_unauth_destination

  2. Created /etc/postfix/sender_access mydomain OK

  3. postmap /etc/postfix/sender_access and postfix reload

However we keep getting logs accepting mails from other domains,

postfix/smtpd[27967]: connect from unknown[Public IP MDaemon]
postfix/smtpd[27967]: EBC3826081: client=unknown[Public IP MDaemon]
postfix/cleanup[27970]: EBC3826081: message-id=etPan.6d56418c.db552cb5.527d@server.local
postfix/qmgr[27675]: EBC3826081: from=otheruser@otherdomain, size=33492, nrcpt=1 (queue active)
postfix/smtpd[27967]: disconnect from unknown[Public Ip Maemon]
postfix/smtp[27971]: EBC3826081: to=<oneuser@onedomain>, ..., status=sent (250 Ok, message saved <Message-ID: etPan.6d56418c.db552cb5.527d@server.local>)

or sometimes is rejected by antispammers (blacklist, greylists,..).

So, we will be grateful if you could help us to make this work, and any suggestion to secure this environment will be welcome.

  • Mail servers are supposed to accept mail addressed to users on them, and they are also supposed to relay for valid users (how you determine they are valid is up to you). I think that if you don't want to see those sorts of messages, you will need to sort out your MDaemon install. – NickW Dec 31 '13 at 12:04
1

I'm not sure I really understood what you are asking for, but this answer might help you understanding what's going on :

According to the logs you provided, you receive mail from the MDaemon server.

Since you put his IP in mynetworks, mail will automatically be accepted. No further processing will be done, especially /etc/postfix/sender_access won't be checked.

Put an IP adresse in mynetworks only if you really trust all mail originating from it, blindly.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.