I want to allow PHP apps to send mail but under very restricted conditions.
And I don't want to allow sendmail-like command for PHP apps (I'm using chrooted PHP and it's too much headache), thus I disabled
mail() function in PHP.
What options do I have to strictly allow/monitor PHP apps sending via my postfix?
- HELO name can be spoofed
- IP can be spoofed and it's not explicitly linked to a PHP app user
AUTH? Should I also require
I already have a
smtpd on port 587 running which uses
smtpd_sasl_type=dovecot but I don't suppose a PHP app would ever have an account on Dovecot IMAP server - I suppose most PHP apps would send mail as 'noreply@'. Should I create another instance of