On 2013-03-13 Viktor Dukhovni wrote: > On Wed, Mar 13, 2013 at 01:48:57PM +0100, Ansgar Wiechers wrote: >>> Mar 12 17:13:01 mediaserver postfix/smtpd[12785]: NOQUEUE: reject: >>> RCPT from ip68-227-115-116.ok.ok.cox.net[68.227.115.116]: 451 4.3.5 >>> <recipi...@domain.com>: Recipient address rejected: Server >>> configuration error; from=<aaroncrai...@bayesianmarketing.com> >>> to=<reciepi...@domain.com> proto=ESMTP >> >> The message "Server configuration error" is curious, though. Please >> post the output of "grep 12785 /var/log/mail.log". > > That's the problem: mail is rejected because of configuration errors, > not incorrectly applied. policy.
I think so, too. That's why I asked for the log entries from this particular smtpd process. >>> smtpd_recipient_restrictions = >>> permit_sasl_authenticated >>> check_recipient_access hash:/etc/postfix/filtered_domains >>> permit_mynetworks >>> reject_unauth_destination >>> smtpd_sender_restrictions = permit_sasl_authenticated permit_mynetworks >> >> "check_recipient_access" should go *after* "reject_unauth_destination", >> otherwise you're prone to becoming an open relay. > > No, it is generally safe to do recipient access lookups, even before > anti-relay policy, since the recipient cannot be spoofed. Just don't > allow mail to recipients in outside domains. The latter is what I meant by "prone to becoming an open relay". Is there any advantage in putting check_recipient_access before reject_unauth_destination? If not I'd recommend sticking with the safe variant. Regards Ansgar Wiechers -- "Abstractions save us time working, but they don't save us time learning." --Joel Spolsky
