On 11/22/2014 6:03 PM, Wietse Venema wrote: > deoren: >> Is there a way to accomplish what the Linux Email book mentions? >> Basically restricting use of your domain to your clients/backup >> MX and using a custom response or log message to indicate what >> rule blocked offenders? > > /etc/postfix/main.cf: > smtpd_client_restrictions = > permit_mynetworks permit_sasl_authenticated reject > > This will block mail with "access denied". If that is not sufficient: > > /etc/postfix/main.cf: > smtpd_reject_footer = \c. See http://www.example.com/mail-reject. blah > blah. > > This will append the specified text to reject responses. > > http://www.postfix.org/postconf.5.html#smtpd_reject_footer > > You can provide custom responses with access maps but no-one is > going to look at that stuff, and many email readers don't even show > it to the user. > > Wietse
I wasn't aware of the smtpd_reject_footer option (I've a lot to learn), so thank you for mentioning it. Thanks again for taking the time to respond. I'm sorry to say that I wasn't very clear when I asked if there was a way to restrict use of your domain to your clients/backup MX. You responded showing a way to restrict clients to just those that are listed within $mynetworks and to those users who have authenticated. All other clients are rejected. I'm guessing this includes other mail servers as well, so this particular ruleset would not apply to a primary or backup MX server. The question I had would have been better phrased as, "Is there a way to limit which clients can claim to be from your domain(s) when sending mail?" After doing some additional digging it looks like "Envelope sender address authorization" is what I'm looking for? http://www.postfix.org/SASL_README.html#server_sasl_authz_envelope Regarding the remote clients not reading the custom responses, I agree that it wouldn't be realistic to expect that. I've been providing custom responses with access maps, but more for my purposes. I have some (crude) scripts that look for rejections with custom messages and skip mentioning those in the rejection reports that I receive. We have a really small number of users, so I'm able to deal with the reports and tune the servers as necessary. So far it's been a great learning opportunity.
