Re: check_sender_access and pattern matching

2015-12-30 Thread Bill Cole
On 30 Dec 2015, at 20:45, Alex wrote: Hi, I hoped I could ask another question. Well, you can ask... Below is my smtpd_recipient_restrictions as we were discussing earlier this week: On Sun, Dec 27, 2015 at 9:37 PM, Bill Cole wrote: On 27 Dec 2015, at 20:22, Alex wrote: [...] smtpd_reci

Re: check_sender_access and pattern matching

2015-12-30 Thread Noel Jones
On 12/30/2015 7:45 PM, Alex wrote: > > The docs say reject_unlisted_recipient rejects mail when the recipient > is not listed in the list of valid recipients for its domain class. I > assume this means an IP listed in mynetworks or an entry from the > check_recipient_access list? > > The part I d

Re: check_sender_access and pattern matching

2015-12-30 Thread Alex
Hi, I hoped I could ask another question. Below is my smtpd_recipient_restrictions as we were discussing earlier this week: On Sun, Dec 27, 2015 at 9:37 PM, Bill Cole wrote: > On 27 Dec 2015, at 20:22, Alex wrote: > [...] > smtpd_recipient_restrictions = > reject_non_fqdn_recipient, > reject

Re: check_sender_access and pattern matching

2015-12-28 Thread Alex
Hi, On Mon, Dec 28, 2015 at 12:17 AM, Bill Cole wrote: > On 27 Dec 2015, at 22:48, Alex wrote: > >> Hopefully the smtpd_sender_restrictions I posted above is correct, but >> I will also have to either add the IPs to mynetworks or duplicate the >> check_sender_access map in smtpd_recipient_restric

Re: check_sender_access and pattern matching

2015-12-27 Thread Bill Cole
On 27 Dec 2015, at 22:48, Alex wrote: Hopefully the smtpd_sender_restrictions I posted above is correct, but I will also have to either add the IPs to mynetworks or duplicate the check_sender_access map in smtpd_recipient_restrictions to avoid being rejected in the RBLs there, correct? If you

Re: check_sender_access and pattern matching

2015-12-27 Thread Alex
Hi, > As I understand your problem, there is mail which you must accept that uses > a sender domain name which does not resolve. However, you generally want to > use reject_unknown_sender_domain, which is a good thing. > > The ideal way to address that problem is a check_sender_access map with you

Re: check_sender_access and pattern matching

2015-12-27 Thread Bill Cole
On 27 Dec 2015, at 20:22, Alex wrote: [...] smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_non_fqdn_sender, reject_unlisted_recipient, reject_unknown_recipient_domain, permit_mynetworks, reject_unauth_destination, reject_unknown_sender_domain, reject_rhsbl_reve

Re: check_sender_access and pattern matching

2015-12-27 Thread Alex
Hi, >> It's taken me a few days to process what you've written, but I think >> I'm now on the right track. Just to be sure I understand, I'd like to >> list my smtpd_*_restrictions and ask if someone could review them. >> >> I have a list of domain names and IPs that I need to ensure are not >> re

Re: check_sender_access and pattern matching

2015-12-27 Thread Bill Cole
On 27 Dec 2015, at 13:24, Alex wrote: Hi, On Wed, Dec 23, 2015 at 3:34 PM, Bill Cole wrote: On 23 Dec 2015, at 13:53, Alex wrote: [...] Okay, I understand. So if the list wasn't also included in smtpd_sender_restrictions, would it have been rejected there, due to the reject_unknown_sender_

Re: check_sender_access and pattern matching

2015-12-27 Thread Alex
Hi, On Wed, Dec 23, 2015 at 3:34 PM, Bill Cole wrote: > On 23 Dec 2015, at 13:53, Alex wrote: > > [...] > >> Okay, I understand. So if the list wasn't also included in >> smtpd_sender_restrictions, would it have been rejected there, due to >> the reject_unknown_sender_domain at the end? > > > Yes

Re: check_sender_access and pattern matching

2015-12-23 Thread Bill Cole
On 23 Dec 2015, at 13:53, Alex wrote: [...] Okay, I understand. So if the list wasn't also included in smtpd_sender_restrictions, would it have been rejected there, due to the reject_unknown_sender_domain at the end? Yes. How can I get around the duplication? If you don't duplicate reject

Re: check_sender_access and pattern matching

2015-12-23 Thread Alex
Hi, On Wed, Dec 23, 2015 at 12:53 PM, Bill Cole wrote: > On 21 Dec 2015, at 12:38, Alex wrote: > >> Perhaps the ordering of restrictions is not correct? >> >> smtpd_client_restrictions = permit_mynetworks, >> check_client_access hash:/etc/postfix/client_checks, >> check_reverse_client_hostname_

Re: check_sender_access and pattern matching

2015-12-23 Thread Bill Cole
On 21 Dec 2015, at 12:38, Alex wrote: Perhaps the ordering of restrictions is not correct? smtpd_client_restrictions = permit_mynetworks, check_client_access hash:/etc/postfix/client_checks, check_reverse_client_hostname_access pcre:/etc/postfix/fqrdns-042715a.pcre, check_reverse_client_ho

Re: check_sender_access and pattern matching

2015-12-21 Thread Alex
Hi, On Mon, Dec 21, 2015 at 2:18 PM, Noel Jones wrote: > On 12/21/2015 12:13 PM, Alex wrote: >>> For hash: access tables, the correct line is (assuming the default >>> value of parent_domain_matches_subdomains): >>> >>> invalid.example.com OK >>> >>> See the access table documentation, pattern s

Re: check_sender_access and pattern matching

2015-12-21 Thread Noel Jones
On 12/21/2015 12:13 PM, Alex wrote: >> For hash: access tables, the correct line is (assuming the default >> value of parent_domain_matches_subdomains): >> >> invalid.example.com OK >> >> See the access table documentation, pattern search order section for >> details. >> http://www.postfix.org/acc

Re: check_sender_access and pattern matching

2015-12-21 Thread Alex
Hi, On Mon, Dec 21, 2015 at 12:48 PM, Noel Jones wrote: > On 12/21/2015 11:38 AM, Alex wrote: >> Hi, >> I have a postfix-2.10 fedora22 system and having trouble with my >> sender checks. I have a domain that is sending mail with an invalid >> hostname. The temporary solution is to add a check_sen

Re: check_sender_access and pattern matching

2015-12-21 Thread Noel Jones
On 12/21/2015 11:38 AM, Alex wrote: > Hi, > I have a postfix-2.10 fedora22 system and having trouble with my > sender checks. I have a domain that is sending mail with an invalid > hostname. The temporary solution is to add a check_sender_access > entry, but I must be doing something wrong. > > De