Hello, I'm needing to set up an helo exception for a single host.
Mar 20 18:19:11 mail postfix/smtpd[53636]: connect from xxx.xxx.xxx[xxx.xxx.xxx.xxx] Mar 20 18:19:11 mail postfix/smtpd[53636]: Anonymous TLS connection established from xxx.xxx.xxx[xxx.xxx.xxx.xxx]: TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits) Mar 20 18:19:12 mail postfix/smtpd[53636]: NOQUEUE: reject: RCPT from xxx.xxx.xxx.xxx[xxx.xxx.xxx.xxx]: 550 5.7.1 <mail.xx.xxx.xxx>: Helo command rejected: Host not found; from=<x...@xxx.xxx> to=<x...@xxx.xxx> proto=ESMTP helo=<mail.xx.xxx.xxx> Mar 20 18:19:12 mail postfix/smtpd[53636]: disconnect from xxx.xxx.xxx[xxx.xxx.xxx.xxx] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 rset=1 quit=1 commands=6/8 Googling brought me to an issue where this was discussed pointing to reject_unknown_helo_hostname as the likely culprit since the mail server a and ptr records are working fine, but the helo it's sending doesn't reverse ptr. The fix was a suggestion of commenting out reject_unknown_helo_hostname checking: https://serverfault.com/questions/922935/why-does-postfix-say-helo-command-rejected-host-not-found-when-dig-finds-the http://www.postfix.org/postconf.5.html#reject_invalid_helo_hostname I don't want to blanket disable reject_unknown_helo_hostname is there a way I can set a helo exception for this one host/sender? My helo section is below with the commented out option: # helo restrictions smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks permit_sasl_authenticated reject_invalid_helo_hostname reject_non_fqdn_helo_hostname #reject_unknown_helo_hostname check_helo_access hash:/usr/local/etc/postfix/helo_access, and my complete postconf -n output #postconf -n allow_percent_hack = no append_dot_mydomain = no biff = no bounce_queue_lifetime = 1h bounce_template_file = /usr/local/etc/postfix/bounce.cf broken_sasl_auth_clients = no command_directory = /usr/local/sbin compatibility_level = 2 daemon_directory = /usr/local/libexec/postfix data_directory = /var/db/postfix delay_warning_time = 4h disable_vrfy_command = yes header_checks = regexp:/usr/local/etc/postfix/phish419.regexp html_directory = no in_flow_delay = 1s inet_interfaces = xxx.xxx.xxx.xxx inet_protocols = ipv4 lmtp_tls_mandatory_protocols = $smtpd_tls_mandatory_protocols lmtp_tls_protocols = $smtpd_tls_protocols local_recipient_maps = $virtual_mailbox_maps mail_owner = postfix mailbox_size_limit = 0 mailq_path = /usr/local/bin/mailq manpage_directory = /usr/local/man maximal_backoff_time = 15m maximal_queue_lifetime = 1h message_size_limit = 52428800 meta_directory = /usr/local/libexec/postfix milter_default_action = accept milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen} milter_protocol = 6 mime_header_checks = regexp:/usr/local/etc/postfix/mime_header_checks minimal_backoff_time = 5m mydestination = mail.example.com mydomain = example.com myhostname = mail.example.com mynetworks = $config_directory/mynetworks myorigin = $mydomain newaliases_path = /usr/local/bin/newaliases non_smtpd_milters = $smtpd_milters postscreen_access_list = permit_mynetworks, cidr:/usr/local/etc/postfix/postscreen_access.cidr, cidr:/usr/local/etc/postfix/postscreen_spf_whitelist.cidr postscreen_bare_newline_action = enforce postscreen_bare_newline_enable = yes postscreen_blacklist_action = drop postscreen_cache_cleanup_interval = 0 postscreen_cache_map = proxy:btree:${data_directory}/postscreen_cache postscreen_dnsbl_action = enforce postscreen_dnsbl_reply_map = pcre:$config_directory/postscreen_dnsbl_reply_map.pcre postscreen_dnsbl_sites = zen.spamhaus.org*3 b.barracudacentral.org*2 bl.spameatingmonkey.net*2 bl.spamcop.net dnsbl.sorbs.net psbl.surriel.com bl.mailspike.net list.dnswl.org=127.[0..255].[0..255].0*-2 list.dnswl.org=127.[0..255].[0..255].1*-3 list.dnswl.org=127.[0..255].[0..255].[2..255]*-4 postscreen_dnsbl_threshold = 3 postscreen_dnsbl_whitelist_threshold = -1 postscreen_greet_action = enforce postscreen_non_smtp_command_enable = yes postscreen_pipelining_enable = yes queue_directory = /var/spool/postfix queue_run_delay = 5m readme_directory = no recipient_delimiter = + sample_directory = /usr/local/etc/postfix sendmail_path = /usr/local/sbin/sendmail setgid_group = maildrop shlib_directory = /usr/local/lib/postfix show_user_unknown_table_name = no smtp_helo_timeout = 60s smtp_tls_CApath = $smtpd_tls_CApath smtp_tls_ciphers = high smtp_tls_loglevel = 1 smtp_tls_mandatory_ciphers = medium smtp_tls_mandatory_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA smtp_tls_mandatory_protocols = $smtpd_tls_mandatory_protocols smtp_tls_protocols = $smtpd_tls_protocols smtp_tls_security_level = may smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_use_tls = yes smtpd_banner = $myhostname ESMTP smtpd_client_restrictions = permit_sasl_authenticated reject_unknown_reverse_client_hostname check_client_access cidr:/usr/local/etc/postfix/spamfarms check_client_access cidr:/usr/local/etc/postfix/sinokorea.cidr check_client_access cidr:/usr/local/etc/postfix/incoming_blacklist check_reverse_client_hostname_access pcre:/usr/local/etc/postfix/fqrdns.pcre smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks permit_sasl_authenticated reject_invalid_helo_hostname reject_non_fqdn_helo_hostname check_helo_access hash:/usr/local/etc/postfix/helo_access, smtpd_milters = unix:/var/run/rspamd/milter.sock,inet:127.0.0.1:8472 smtpd_recipient_restrictions = reject_non_fqdn_recipient reject_unknown_recipient_domain reject_unauth_pipelining check_recipient_access mysql:/usr/local/etc/postfix/db/recipient-access.cf permit_dnswl_client list.dnswl.org=127.0.[2..14].[1..3] reject_unlisted_recipient check_policy_service unix:private/spf-policy check_policy_service unix:private/dovecot-quota smtpd_reject_unlisted_sender = yes smtpd_relay_restrictions = permit_sasl_authenticated permit_mynetworks reject_unauth_destination smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_local_domain = $mydomain smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_tls_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sender_restrictions = reject_non_fqdn_sender reject_unknown_sender_domain ,check_sender_mx_access cidr:/usr/local/etc/postfix/bogus_mx check_sender_access hash:/usr/local/etc/postfix/safe_addresses check_sender_access hash:/usr/local/etc/postfix/auto-whtlst smtpd_soft_error_limit = 3 smtpd_tls_CAfile = /usr/local/etc/ssl/acme.sh/example.com/cacert.crt smtpd_tls_CApath = /etc/ssl/certs smtpd_tls_auth_only = yes smtpd_tls_ciphers = high smtpd_tls_dh1024_param_file = /usr/local/etc/postfix/dhparams.pem smtpd_tls_eccert_file = /usr/local/etc/ssl/acme.sh/example.com/fullchain.crt smtpd_tls_eckey_file = /usr/local/etc/ssl/acme.sh/example.com/private/server-ec256.key smtpd_tls_eecdh_grade = ultra smtpd_tls_exclude_ciphers = $smtpd_tls_mandatory_exclude_ciphers smtpd_tls_loglevel = 1 smtpd_tls_mandatory_ciphers = high smtpd_tls_mandatory_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, KRB5-DES, CBC3-SHAi smtpd_tls_mandatory_protocols = TLSv1.3,TLSv1.2,!TLSv1.1,!TLSv1,!SSLv3,!SSLv2 smtpd_tls_protocols = TLSv1.3,TLSv1.2,!TLSv1.1,!TLSv1,!SSLv3,!SSLv2 smtpd_tls_received_header = yes smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtpd_use_tls = yes soft_bounce = no spf-policy_time_limit = 3600s strict_rfc821_envelopes = yes swap_bangpath = no tls_high_cipherlist = ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1 tls_preempt_cipherlist = yes tls_ssl_options = no_ticket, no_compression unknown_address_reject_code = 550 unknown_client_reject_code = 550 unknown_hostname_reject_code = 550 unknown_local_recipient_reject_code = 550 virtual_alias_maps = proxy:mysql:/usr/local/etc/postfix/db/aliases.cf virtual_gid_maps = static:2100 virtual_mailbox_base = /var/vmail virtual_mailbox_domains = proxy:mysql:/usr/local/etc/postfix/db/domains.cf virtual_mailbox_maps = proxy:mysql:/usr/local/etc/postfix/db/accounts.cf virtual_minimum_uid = 2100 virtual_transport = lmtp:unix:private/dovecot-lmtp virtual_uid_maps = static:2100 As I said a rejection would be nice. If I've got any other glaring config issues or things that could be improved please let me know. Thanks. Dave.
