On 12 Jul 2014, at 9:19, D'Arcy J.M. Cain wrote:
I want to ask the question "Who connected,
confirmed a valid address and disconnected without sending mail?" Is
that an unreasonable question without needing to do stateful log
analysis? It's not that I am a stranger to that sort of log analysis
but the Postfix engine already has that information. All I am saying
is that it would be nice if the lost connection message (or a separate
message) made note of the status at the time of disconnection.
Actually, a separate log entry makes sense because I want to know that
information whether the connection was dropped properly or not. In
other words, after a disconnect of any sort I want to know if the
sender
sent an invalid address, a valid one which it followed up with DATA or
a valid one that it did not follow up.
A formally well-behaved address verifier is most obvious in Postfix
syslog messages by obscurity. This is all syslog messages generated by a
manual SMTP session testing 6 addresses and disconnecting properly:
Sat Jul 12 18:54:45 toaster postfix/postscreen[65414] <Info>: CONNECT
from [127.0.0.1]:64826 to \[127.0.0.1\]:25
Sat Jul 12 18:54:45 toaster postfix/postscreen[65414] <Info>:
WHITELISTED [127.0.0.1]:64826
Sat Jul 12 18:54:45 toaster postfix/smtpd[65416] <Info>: connect from
localhost[127.0.0.1]
Sat Jul 12 18:55:06 toaster postfix/smtpd[65416] <Info>:
3h9mff597Zz1XtTxB: client=localhost[127.0.0.1]
Sat Jul 12 18:56:18 toaster postfix/smtpd[65416] <Info>: disconnect from
localhost[127.0.0.1]
IOW: Postfix logs nothing about what a client does unless it results in
a failure reply or a queued message.
Absent a log message from Postfix itself, you could get a message out of
a milter (e.g. MIMEDefang) of each RCPT.
