Ralph Seichter:
> Hello list.
>
> I am currently pondering the continued usefulness of the restriction
>
> smtpd_recipient_restrictions =
> ...
> check_recipient_access pcre:/etc/postfix/recipient_access
> ...
>
> with the content of /etc/postfix/recipient_access (1) being:
>
> /[@!%].*[@!%]/ REJECT
>
> As per RFC 5322, "!" and "%" are members of the atext character class,
> meaning they are permitted, and I don't want to trigger a debate about
> whether or not it is wise to use them.
>
> My question is if there is a valid reason to reject based on "%" in PCRE
> pattern (1) in this day and age, or if this character can be dropped
> without detrimental effect?
>
> For context, GMX allows its users to create distribution aliases in the
> format <foobar%someu...@gmx.net>, so this is not just idle speculation.
First to address some potential misconception: Postfix will happily
receive and send email to <foobar%someu...@gmx.net>. The '%' and
'!' are special only when the right-hand side is a domain that
Postfix handles mail for (mydestination, relay_domains, etc.).
The default setting "allow_untrusted_routing = no" prevents an open
relay problem when Postfix forwards email to an internal MTA that
resolves user%remote@localdomain to user@remote and relays it back
out to the internet (ditto with remote!user@localdomain, and ditto
with domains in relay_domains).
If Postfix is the final destination for your domain(s), and if it
is not backup MX for other domains, then setting "allow_untrusted_routing
= yes" will be safe. Otherwise, this is UNSAFE unless there is a
guarantee that '%' and '!' in an email address forms will not be
exploitable at other MTAs that Postfix relays mail for.
Wietse
