Re: check_sender_access and spoofing

2015-12-10 Thread Noel Jones
On 12/10/2015 9:17 PM, Alex wrote: >> In that case, rather than using permit_mynetworks you should use a >> separate check_client_access that permits all the authorized IPs. >> >> Make sure to do this in smtpd_sender_restrictions so that settings >> here don't affect relay rules. > > So where I pr

Re: check_sender_access and spoofing

2015-12-10 Thread Alex
Hi, >>> This is independent of SPF. The rules discussed blocks your domain >>> as envelope sender except for a whitelist you have specified >>> (permit_mynetworks). >> >> Yes, and that was part of my concern. There are includes in our SPF >> record for networks that we don't control. I don't want

Re: check_sender_access and spoofing

2015-12-10 Thread Noel Jones
On 12/10/2015 8:39 AM, Alex wrote: >> >> This is independent of SPF. The rules discussed blocks your domain >> as envelope sender except for a whitelist you have specified >> (permit_mynetworks). > > Yes, and that was part of my concern. There are includes in our SPF > record for networks that we

Re: check_sender_access and spoofing

2015-12-10 Thread Alex
Hi, >> This originated with me trying to have a better understanding of SPF. >> check_sender_access consults $mynetworks to determine which servers >> can send mail as my domain. > > Eh? check_sender_access can only check the envelope sender address, > not a network or hostname. Yes, thanks, I do

Re: check_sender_access and spoofing

2015-12-09 Thread Noel Jones
On 12/9/2015 4:17 PM, Alex wrote: > Hi, > >>> I'm trying to configure postfix-3.0.2 to reject mail trying to spoof >>> my domain in the envelope FROM address without rejecting my own >>> domain, and I'm doing something wrong. >> >> Typically this is done something like: >> smtpd_sender_restriction

Re: check_sender_access and spoofing

2015-12-09 Thread Alex
Hi, >> I'm trying to configure postfix-3.0.2 to reject mail trying to spoof >> my domain in the envelope FROM address without rejecting my own >> domain, and I'm doing something wrong. > > Typically this is done something like: > smtpd_sender_restrictions = > permit_mynetworks > check_sender_a

Re: check_sender_access and spoofing

2015-12-09 Thread Noel Jones
On 12/9/2015 11:54 AM, Alex wrote: > Hi, > > I'm trying to configure postfix-3.0.2 to reject mail trying to spoof > my domain in the envelope FROM address without rejecting my own > domain, and I'm doing something wrong. Typically this is done something like: smtpd_sender_restrictions = permit_

check_sender_access and spoofing

2015-12-09 Thread Alex
Hi, I'm trying to configure postfix-3.0.2 to reject mail trying to spoof my domain in the envelope FROM address without rejecting my own domain, and I'm doing something wrong. I've set up check_sender_access to INFO on the entries until I can get this figured out, but here is an example of it log