I have two boxes running sendmail and configured as:

  1. MTA accepting connections from the outside world (mta.xyz.com)
  2. MDA accepting connections from internal network and storing them in user mailboxes (mda.xyz.com)

The MTA doesn't store any emails, it forwards everything to the MDA.

So now, let's say that there is an incoming email to a non-existent account bla@xyz.com:

  1. MTA accepts the recipient and opens an lmtp connection to MDA.
  2. MDA rejects the email with SMTP 550 User unknown error.
  3. MTA rejects the original email with SMTP 550 received from MDA.
  4. MTA closes the connection.
  5. MTA sends an email to postmaster to notify that MDA rejected an email because of error 550 User unknown error

The flow seems reasonable. The email is rejected with error 550 in the original connection and the sender (spammer) is correctly notified about the problem. What bothers me, though, is that MTA is sending each and every rejected email to postmaster, which accounts to a few dozens of unwanted emails a day. MDA doesn't send anything, it just rejects the email. And I am happy for both of them to log the rejections in logs, but how can I convince MTA to just ignore the 550 User unknown errors it receives from the MDA?

My initial thought was to accept only specific email addresses, but MTA in order to accept the emails has to be set up to use xyz.com as its local domain. This means any mailertables and access files are skipped (as far as I can tell).

So now I am thinking about adding to MTA some sendmail rules to accept emails to only specific recipients. I am hoping that if MTA rejects them first it won't bother to send anything to postmaster.

What would you do? Can anyone help with the sendmail rules?

The MTA config:

FEATURE(access_db, `hash -o -T<TMPF> /etc/mail/access')
dnl FEATURE(local_lmtp)
define(`confDOMAIN_NAME', `xyz.com')
(... some cert-related and other unrelated config ...)
define(`confNO_RCPT_ACTION', `add-to-undisclosed')
define(`confPRIVACY_FLAGS', `authwarnings,noexpn,novrfy')
define(`MAIL_HUB', `mda.xyz.com.')
define(`SMART_HOST', `mda.xyz.com.')
define(`confFORWARD_PATH', `')
dnl MAILER(local)

MTA's access file:

Connect:[]     OK
To:xyz.com   RELAY

The MDA config:

FEATURE(access_db, `hash -o -T<TMPF> /etc/mail/access')
dnl FEATURE(local_lmtp)
dnl FEATURE(mailertable, `hash -o /etc/mail/mailertable')
FEATURE(virtusertable, `hash -o /etc/mail/virtusertable')
(... some cert-related and other unrelated configs ...)
define(`confNO_RCPT_ACTION', `add-to-undisclosed')
define(`confPRIVACY_FLAGS', `authwarnings,noexpn,novrfy')

MDA's access file:

To:xyz.com   OK
From:192.168    OK

MDA's virtualusertable:

# In 'aliases' those are redirected to procmail
user1@xyz.com       user1-xyz-com.virtual
user2@xyz.com       user2-xyz-com.virtual

MDA's local-host-names:


Turned out to be much simpler than I initially thought. Just ensure you have the following in your sendmail.cf:

FEATURE(access_db, `hash -o -T<TMPF> /etc/mail/access' `relaytofulladdress')

Note the relaytofulladdress.

Now you can selectively accept specific addresses and reject the rest in access:

Connect:[]     OK
To:user1@xyz.com        RELAY
To:postmaster@xyz.com   RELAY
To:xyz.com              REJECT

Note the Connect entry to accept local email as well as postmaster@ to accept any administration emails (similar would be for webmaster@ and others if you use them).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.