Sendmail's MTA, MDA and SMTP 550 User Unknown forwarded to postmaster

Question

I have two boxes running sendmail and configured as:

1. MTA accepting connections from the outside world (mta.xyz.com)
2. MDA accepting connections from internal network and storing them in user mailboxes (mda.xyz.com)

The MTA doesn't store any emails, it forwards everything to the MDA.

So now, let's say that there is an incoming email to a non-existent account [email protected]:

1. MTA accepts the recipient and opens an lmtp connection to MDA.
2. MDA rejects the email with SMTP 550 User unknown error.
3. MTA rejects the original email with SMTP 550 received from MDA.
4. MTA closes the connection.
5. MTA sends an email to postmaster to notify that MDA rejected an email because of error 550 User unknown error

The flow seems reasonable. The email is rejected with error 550 in the original connection and the sender (spammer) is correctly notified about the problem. What bothers me, though, is that MTA is sending each and every rejected email to postmaster, which accounts to a few dozens of unwanted emails a day. MDA doesn't send anything, it just rejects the email. And I am happy for both of them to log the rejections in logs, but how can I convince MTA to just ignore the 550 User unknown errors it receives from the MDA?

My initial thought was to accept only specific email addresses, but MTA in order to accept the emails has to be set up to use xyz.com as its local domain. This means any mailertables and access files are skipped (as far as I can tell).

So now I am thinking about adding to MTA some sendmail rules to accept emails to only specific recipients. I am hoping that if MTA rejects them first it won't bother to send anything to postmaster.

What would you do? Can anyone help with the sendmail rules?

The MTA config:

DOMAIN(generic)
LOCAL_DOMAIN(`xyz.com')
FEATURE(access_db, `hash -o -T<TMPF> /etc/mail/access')
dnl FEATURE(local_lmtp)
define(`confDOMAIN_NAME', `xyz.com')
(... some cert-related and other unrelated config ...)
define(`confNO_RCPT_ACTION', `add-to-undisclosed')
define(`confPRIVACY_FLAGS', `authwarnings,noexpn,novrfy')
define(`MAIL_HUB', `mda.xyz.com.')
define(`SMART_HOST', `mda.xyz.com.')
define(`confFORWARD_PATH', `')
dnl MAILER(local)
MAILER(smtp)

MTA's access file:

Connect:[127.0.0.1]     OK
To:xyz.com   RELAY

The MDA config:

DOMAIN(generic)
FEATURE(access_db, `hash -o -T<TMPF> /etc/mail/access')
FEATURE(blacklist_recipients)
FEATURE(`use_cw_file')
FEATURE(`smrsh')
dnl FEATURE(local_lmtp)
dnl FEATURE(mailertable, `hash -o /etc/mail/mailertable')
FEATURE(virtusertable, `hash -o /etc/mail/virtusertable')
FEATURE(`local_procmail_lmtp')
(... some cert-related and other unrelated configs ...)
define(`confNO_RCPT_ACTION', `add-to-undisclosed')
define(`confPRIVACY_FLAGS', `authwarnings,noexpn,novrfy')
MAILER(local)
MAILER(smtp)
MAILER(procmail)

MDA's access file:

To:xyz.com   OK
From:192.168    OK

MDA's virtualusertable:

# In 'aliases' those are redirected to procmail
[email protected]       user1-xyz-com.virtual
[email protected]       user2-xyz-com.virtual

MDA's local-host-names:

xyz.com
somesubdomain.xyz.com

Answer 1

Turned out to be much simpler than I initially thought. Just ensure you have the following in your sendmail.cf:

FEATURE(access_db, `hash -o -T<TMPF> /etc/mail/access' `relaytofulladdress')
FEATURE(blacklist_recipients)

Note the relaytofulladdress.

Now you can selectively accept specific addresses and reject the rest in access:

Connect:[127.0.0.1]     OK
To:[email protected]        RELAY
To:[email protected]   RELAY
To:xyz.com              REJECT

Note the Connect entry to accept local email as well as postmaster@ to accept any administration emails (similar would be for webmaster@ and others if you use them).