i'm looking for a bit of advice on Postfix restrictions configuration. I'm looking for a balanced configuration which properly rejects spam and unauthorized access retries.
Lately, i've been reading some docs and trying to learn from other's experience, but i'm a bit confused when restrictions comes about. Right now i'm being forced to set permit_sasl_authenticated as first restriction so authenticated users does not match against spam blocking lists while sending email from their desktop email client application. If i remove such restriction then people sending email through desktop email client applications such MS Outlook and which are connected to the net through ADSL or behind dynamic ips, usually is detected as spam.
I'm wondering if i have missed anything as when reading others configuration, tutorials and docs they look like not suffering from that issue. i feel like i'm the only one.
I'm also wondering if i'm checking against the right spam lists at each restriction statement.
mynetworks_style = host smtpd_client_restrictions = permit_sasl_authenticated, reject_rbl_client sbl.spamhaus.org, reject_rbl_client blackholes.easynet.nl ,reject_rbl_client zen.spamhaus.org ,reject_rbl_client bl.spamcop.net ,check_client_access regexp:/etc/postfix/client_restrictions smtpd_data_restrictions = reject_unauth_pipelining smtpd_end_of_data_restrictions = smtpd_etrn_restrictions = smtpd_helo_restrictions = permit_mynetworks, check_helo_access hash:/etc/postfix/helo_access, permit_sasl_authenticated, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_pipelining, permit_mynetworks, reject_non_fqdn_recipient, warn_if_reject reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, warn_if_reject reject_unknown_helo_hostname, check_policy_service inet:127.0.0.1:10023, check_policy_service unix:private/policy-spf, permit smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination smtpd_restriction_classes = smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit
One issue i faced was
bl.sorbs.net detecting some Microsoft IPs as spam.
Any kind of tips and advices are welcome.
Thanks a lot!