[pfx] Encoding other information into VERP

2024-07-14 Thread Dan Mahoney (Gushi) via Postfix-users
Hey all, The dayjob is attempting to tie VERP into our ticket system (RT with postfix), and it would be useful to encode not just the magic "from" address, but ideally the ticket number as well, so that a bounced reply to the customer can be added to the ticket stream. So if normal verp (per

[pfx] Different set of milters for one domain?

2023-03-28 Thread Dan Mahoney (Gushi) via Postfix-users
Hey there all, Dayjob sometimes receives mail for one domain that we'd like to have bypass certain milters (specifically, we want to exempt them from some filtering/scanning mitlers since the domain is pretty much entirely passthrough) -- Is there an easy way to do this in postfix without co

How to forward to aliases with correct envelope sender

2022-11-18 Thread Dan Mahoney (Gushi)
Hey there all, At the day job, we periodically do an export of our ticketing system into an internal alias where the alias does an :include:. However, recently, outlook365 decided it did not like having secret-al...@support.dayjob.org as the To: envelops -- and we'd rather not have that in t

Re: Some DNSSEC/DANE questions

2022-01-03 Thread Dan Mahoney (Gushi)
On Mon, 3 Jan 2022, Dan Mahoney wrote: This is a problem when your local resolver is slaving the root zone, as a standard root zone "type slave" will hand . NS out with the AA bit set, but will not set the AD bit. There's a feature in more recent versions of BIND (mirror zones) that may fix

Some DNSSEC/DANE questions

2022-01-03 Thread Dan Mahoney (Gushi)
Hey there, We run validating resolvers at the day job, but by default not on the box where postfix runs. (I.e. we rely on the AD bit). In reading over what's required to enable DANE support in postfix, I see that there's a compile-time requirement for the DNS lib in the OS to support it, wh

Re: Macro explanation?

2022-01-01 Thread Dan Mahoney (Gushi)
On Sat, 1 Jan 2022, Wietse Venema wrote: Dan Mahoney (Gushi): Hey there, I'm trying to modernize older configs at the day job and have found that a coworker specified: milter_connect_macros = b i j _ {daemon_name} {if_name} {if_addr} milter_end_of_data_macros = b i j _ {daemon_name} {if

Macro explanation?

2022-01-01 Thread Dan Mahoney (Gushi)
Hey there, I'm trying to modernize older configs at the day job and have found that a coworker specified: milter_connect_macros = b i j _ {daemon_name} {if_name} {if_addr} milter_end_of_data_macros = b i j _ {daemon_name} {if_name} {if_addr} {mail_addr} Consulting http://www.postfix.org/MIL

"Correct" way to override cipher list?

2021-10-29 Thread Dan Mahoney (Gushi)
Hey there all, I'm in the process of vetting historical postfix configs -- comparing so many things in a historic config where prior employees overrode the defaults and perhaps why. Wietse, let me say thank you for making it easier than it would be with sendmail.cf :) I see sites like ciph

Way to apply a postfix rule to both FROM and TO?

2021-10-17 Thread Dan Mahoney (Gushi)
Hey there all, I've wondered this a while. It seems the old Sendmail access maps, and following that postfix have managed to allow you to apply a rule on things like: CONNECTED VIA specific IP. FROM a specific mailbox TO a specific mailbox But never more than one of these. Is there any eas

Overriding nonexistent site error for auth'd hosts.

2021-10-03 Thread Dan Mahoney (Gushi)
Hey there, We have an interesting problem, at the dayjob. We recently decommed a site, as in, removed it from forward DNS, but it's still sending us root mail, which postfix is rejecting with unknown hostname. (Totally reasonably) Now, it's sending using an SSL cert that we've marked as tru

Re: Best current practice to analyze brute force login attempts?

2021-09-01 Thread Dan Mahoney (Gushi)
On Wed, 1 Sep 2021, Leandro Santiago wrote: Hey All, Looks like my original mail from Hadmut got eaten by voracious thread-cleaning. Sorry for the top post. I use sendmail in my daily life, not postfix, but I have a ~100 line perl script that basically: Looks for: Sep 1 06:51:42 prime

OpenDMARC 1.4.1 Released

2021-04-29 Thread Dan Mahoney (Gushi)
Hey there, A cross post because there's enough dmarc discussion to be relevant. We've just released OpenDMARC 1.4.1 over at https://github.com/trusteddomainproject/OpenDMARC While the delta between 1.4.0 and 1.4.1 may seem minor if one goes by the version numbers, it's actually a pretty solid

Trusting postfix client certs for relaying

2021-04-17 Thread Dan Mahoney (Gushi)
All, The dayjob has a number of machines out in the wild that need to be able to send mail (mostly from cron jobs) home to the mothership. Not all have controllable reverse DNS. It's an issue with donated colo and transit. Doing a bunch of tunnels would work but it's a really stupid answer.

OpenDMARC 1.4.1 pre-release announcement

2021-04-16 Thread Dan Mahoney (Gushi)
All, Apologies that this isn't postfix software specific. Because it gets discussed enough here, myself and the others on the opendmarc team are coming pretty close to releasing opendmarc 1.4.1, which includes a lot of rework to both our own inbuilt SPF handling code, as well as a number of o

Re: Milters and policy

2021-04-02 Thread Dan Mahoney (Gushi)
On Sat, 3 Apr 2021, Simon Wilson wrote: Please read CVE-2019-20790, and tell me you’ve found a way to tell PyPolicyd not to trust the SMTP HELO to generate a passing AR header. This is possibly off-topic for the Postfix list... maybe not. …with tongue in cheek, I’ll take all the discussion

Re: Milter Behavior

2021-03-10 Thread Dan Mahoney (Gushi)
On Wed, 10 Mar 2021, Wietse Venema wrote: Dan Mahoney (Gushi): Postifix has a concept of quarantine. It is called the HOLD queue. As of 2006, when the Milter says QUARANTINE, then Postfix will quarantine the message, i.e. place it in the HOLD queue, for admins to deal with manually. Yes

Re: Milter Behavior

2021-03-10 Thread Dan Mahoney (Gushi)
On Wed, 10 Mar 2021, Claus Assmann wrote: On Wed, Mar 10, 2021, Dan Mahoney (Gushi) wrote: Yes, and I am asking if there is a postfix knob that says "I know what the milter says, but I want something different, because postfix doesn't know ... Why don't you "fix"

Re: Milter Behavior

2021-03-10 Thread Dan Mahoney (Gushi)
On Wed, 10 Mar 2021, Wietse Venema wrote: Dan Mahoney (Gushi): All, I'm working with the OpenDMARC folks on doing bug triage, and someone has requested that if a domain's policy says p=quarantine, that it should be "accepted" by postfix, and left for something like SpamA

Milter Behavior

2021-03-10 Thread Dan Mahoney (Gushi)
All, I'm working with the OpenDMARC folks on doing bug triage, and someone has requested that if a domain's policy says p=quarantine, that it should be "accepted" by postfix, and left for something like SpamAssassin to deal with. (I don't see any specific handling in spamassassin that treats

Re: on not being spam - mostly about DKIM and DMARC

2021-02-04 Thread Dan Mahoney (Gushi)
On Thu, 4 Feb 2021, Jeff Abrahamson wrote: 2(a)  I get lots of dmarc reports.  After looking at a few, I started pushing them to a special dmarc mailbox where I don't have to see them.  Is there any sense in which these are actionable ?  Should I occasionally look at them or set a machine to loo

RE: Custom reject message for one address?

2020-09-21 Thread Dan Mahoney (Gushi)
On Mon, 21 Sep 2020, Dan Mahoney (Gushi) wrote: Figured it out. Turns out with a virtual domain, you still need to point it somwhere, and the reject map needs to match the RIGHT HAND SIDE of that map, not the left. In my case, I pointed it at webmaster@localhost, and updated the

RE: Custom reject message for one address?

2020-09-21 Thread Dan Mahoney (Gushi)
On Mon, 21 Sep 2020, Koga Hayashi wrote: Dan, -Original Message- From: owner-postfix-us...@postfix.org On Behalf Of Dan Mahoney (Gushi) Sent: Monday, September 21, 2020 10:29 AM To: postfix-users@postfix.org Subject: Custom reject message for one address? Hey there all, At the

Custom reject message for one address?

2020-09-20 Thread Dan Mahoney (Gushi)
Hey there all, At the dayjob, we're getting enough spam to webmaster@ that we've decided to reroute it to a different address. We'd like to have the bounce messgge let people know about this address. We don't want to send them another message, but we'd like their bounce message to give them

Re: Spoofing Emails to My Own Domain

2019-07-09 Thread Dan Mahoney (Gushi)
On Tue, 9 Jul 2019, @lbutlr wrote: On 9 Jul 2019, at 10:25, bilal.ah...@kfueit.edu.pk wrote: I am facing a problem that someone is spoofing my domain address and sending emails to my own domain users. Why are you accepting remote mail claiming to come from your server? There are lots of th

How to validate alias/map files?

2019-06-27 Thread Dan Mahoney (Gushi)
Hey all, I'm using procedurally-generated alias files from a database, and distributing them with puppet, and would like to have postalias check the files for duplicate entries and/or other errors before I install them. I'd like to use the same program used to install the DB, rather than hack