0

I am running a Postfix mail server. Some domains are configured that the DNS MX record is set to an antispam service. This service is forwarding the good mails to our mailserver. Some sender are ignoring the MX entry so they send the mails (most spam) directly to the postfix server.

So I tested some configuration changes on the Postfix server, that when an emails goes to the specified domains to check which ip sends this email. If it is an ip from the antispam service to accept the mail, all other ips reject the mail.

As reference I took these two sites to configure the postfix mailserver: Postfix Limit mail for domain from IP range and http://www.postfix.org/RESTRICTION_CLASS_README.html

When I test my configuration, i see that the part with the domains is working. But my problem is, all incoming mails for the specified domains are rejected, no email will be accepted, although the ip i send with is allowed.

So here is my Postfix configuration.

main.cf

smtpd_restriction_classes = antispam
antispam = check_sender_access texthash:/etc/postfix/allowed_ips, reject

smtpd_recipient_restrictions =
[... other restrictions ...]
check_recipient_access texthash:/etc/postfix/protected_domains,
permit

allowed_ips

 192.0.2.0/24 PERMIT
 198.51.100.4/32 PERMIT
 0.0.0.0/0 REJECT

protected_domains

 domain.example antispam
 domain2.example antispam
  • "Some sender are ignoring the MX entry so they send the mails (most spam) directly to the postfix server." but how these senders can find your postfix server? how it is announced in DNS? If you know the IP range used by your antispam company you could even filter on the TCP/IP level and let port 25 access only from your antispam IP addresses. – Patrick Mevzek Jul 11 '18 at 18:35
  • Hey Patrick, before we changed dns to antispam service, the affected domains dns mx pointed to this mail server. Problem is most of the domains on this server point with dns mx to this server, just a few domains are using antispam service, so therefore i wish to deny ips only for the domains using antispam service. – Dennis OWG Jul 12 '18 at 6:40
0

check_sender_access matches MAIL FROM: address, not IP. You need to use check_client_access instead.

  • Thanks @AlexD, changed it to: antispam = check_client_access texthash:/etc/postfix/allowed_ips, reject – Dennis OWG Jul 12 '18 at 6:24
  • same result, sender gets rejected mail postfix/smtpd[684]: NOQUEUE: reject: RCPT from xxx[1.2.3.4]: 554 5.7.1 <email@domain.tld>: Recipient address rejected: Access denied; from=<email@sender.tld> to=<email@domain.tld> proto=SMTP helo=<sendingservername.local> – Dennis OWG Jul 12 '18 at 6:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.