Re: Outbound routing decision based on inbound smtpd process

On Thu, Oct 17, 2013 at 8:45 PM, Roel Bouwman wrote: > @Jose: thanks for the suggestion, but sender_dependent transport > maps are not a solution here. As in this case, it's not the sender > address, but the inbound service to which the message was submitted > that should determine how the messag

Question on postfix set up: stopping new connections from outside on smtp server

Hello, I'm looking at the logs for an SMTP only service where iptables should be stopping new connections on port 25, and I'm seeing connects with no sasl auth. They fail to relay, but I'd rather we didn't talk to them at all. In the maillog-internal log: Oct 17 11:28:18 myserver postfix-intern

Re: Question on postfix set up: stopping new connections from outside on smtp server

Am 18.10.2013 15:00, schrieb francis picabia: > I'm looking at the logs for an SMTP only service where iptables > should be stopping new connections on port 25, and I'm > seeing connects with no sasl auth. They fail to relay, but > I'd rather we didn't talk to them at all why do you need iptable

smtpd does not use the content_filter

Although I have a content_filter configration (master.cf): smtp inet n - n - - smtpd -o content_filter = filter:dummy and a appropriate service configuration: filter unix - n n - 10 pipe flags=Rq user=filter null_se

Re: smtpd does not use the content_filter

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi, Rainer Stransky schrieb: >Although I have a content_filter configration (master.cf): > >smtp inet n - n - - smtpd >-o content_filter = filter:dummy vs. >- maillog -- > >Oct 18 14:42:13 aho

Re: smtpd does not use the content_filter

On Fri, Oct 18, 2013 at 03:17:00PM +0200, Rainer Stransky wrote: > Although I have a content_filter configration (master.cf): > >smtp inet n - n - - smtpd >-o content_filter = filter:dummy Also, white-space is not allowed in master.cf option values. Make

Re: Outbound routing decision based on inbound smtpd process

On Fri, Oct 18, 2013 at 01:56:18PM +0100, Jose Borges Ferreira wrote: > On Thu, Oct 17, 2013 at 8:45 PM, Roel Bouwman wrote: > > > @Jose: thanks for the suggestion, but sender_dependent transport > > maps are not a solution here. As in this case, it's not the sender > > address, but the inbound s

Fwd: Question on postfix set up: stopping new connections from outside on smtp server

On Fri, Oct 18, 2013 at 10:12 AM, li...@rhsoft.net wrote: > > Am 18.10.2013 15:00, schrieb francis picabia: >> I'm looking at the logs for an SMTP only service where iptables >> should be stopping new connections on port 25, and I'm >> seeing connects with no sasl auth. They fail to relay, but >>

Maildrop issues

Hi All, Hoping someone can help me out with a bit of advice. I have a custom script that calls postfixs sendmail to send approx 3k emails, and its quick enough that they can all inject into postfixs maildrop queue in under a minute - happy days. Now, in some cases the emails all go into the acti

Re: Maildrop issues

On Fri, Oct 18, 2013 at 03:15:49PM +0100, Mark Berry wrote: > However at other times they can take 30 minutes or more to all go. Slow cleanup(8) processing or disk I/O contention. Another possibility is a syslog daemon configured to do synchronous writes for every log entry (stresses the disk an

Re: Fwd: Question on postfix set up: stopping new connections from outside on smtp server

francis picabia skrev den 2013-10-18 16:04: # smtpinet n - n -60 smtpd If I turn off smtp there, then smtp service can't accept LAN connections on port 25. 127.0.0.1:smtpinet n - n -60 smtpd just not listen on wan ip

Re: Fwd: Question on postfix set up: stopping new connections from outside on smtp server

On Fri, Oct 18, 2013 at 04:32:54PM +0200, Benny Pedersen wrote: > francis picabia skrev den 2013-10-18 16:04: > > >># smtpinet n - n -60 smtpd > > > >If I turn off smtp there, then smtp service can't accept LAN > >connections on port 25. > > 127.0.0.1:smtpinet

Re: Maildrop issues

Viktor Dukhovni: > On Fri, Oct 18, 2013 at 03:15:49PM +0100, Mark Berry wrote: > > > However at other times they can take 30 minutes or more to all go. > > Slow cleanup(8) processing or disk I/O contention. Another > possibility is a syslog daemon configured to do synchronous writes > for every

Re: Fwd: Question on postfix set up: stopping new connections from outside on smtp server

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Viktor Dukhovni schrieb: >On Fri, Oct 18, 2013 at 04:32:54PM +0200, Benny Pedersen wrote: >> francis picabia skrev den 2013-10-18 16:04: >> >> >># smtpinet n - n -60 smtpd >> > >> >If I turn off smtp there, then smtp

Re: Fwd: Question on postfix set up: stopping new connections from outside on smtp server

On Fri, Oct 18, 2013 at 05:25:10PM +0200, Dominik George wrote: > >No, that also turns off SMTP for "LAN" clients. > > Then.. Put your LAN IP there :D. - Typically there is no LAN IP vs WAN IP for a machine that is not dual-homed (e.g. a router). So let's not righteously proclaim unusab

Re: Question on postfix set up: stopping new connections from outside on smtp server

On 10/18/2013 8:00 AM, francis picabia wrote: > Hello, > > I'm looking at the logs for an SMTP only service where iptables > should be stopping new connections on port 25, and I'm > seeing connects with no sasl auth. They fail to relay, but > I'd rather we didn't talk to them at all. > Why do y

Re: Outbound routing decision based on inbound smtpd process

On Fri, Oct 18, 2013 at 3:04 PM, Viktor Dukhovni wrote: > > > If this is the case do a header_check with a regex and then respond a > > "FILTER transport:". > > That's silly, a "-o content_filter=transport:" in master.cf is > simpler and much more robust. The goal is after all to set the > tran

Re: disable ipv6 when sending to gmail ?

HQJaTu writes: > Google chose to change the wording in their 550 error. > 550-5.7.1 [2001:-my-IPv6-address-here-16] Our system has detected > 550-5.7.1 that this message does not meet IPv6 sending guidelines regarding > 550-5.7.1 PTR records and authentication. Please review > 550-5.7.1 https://su

Timeout when delivering to large group of aliases

I wanted to confirm the behavior we are experiencing at the moment when delivering messages to addresses aliased to thousands of local users. For example we have the address distgr...@domain.tld which is an alias to 3000 local users. When our inbound spam filter connects to the Postfix server

Re: disable ipv6 when sending to gmail ?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Mark Martinec schrieb: >IMO, instead of working on workarounds, people's efforts would be >better spent >on setting up their DKIM and/or SPF, reverse DNS mapping, and making >sure that >postfix only binds to an intentionally configured IPv6 address

Re: requiring TLS on a pool of servers

On 2013-10-15 09:48, Dan Langille wrote: On 2013-10-14 20:10, Viktor Dukhovni wrote: On Mon, Oct 14, 2013 at 08:12:01AM -0400, Dan Langille wrote: The master.cf has something like this: 64.147.113.42:5587 inet n - n - - smtpd -o smtp_tls_security_level=encrypt The

Re: What is causing this mail forwarding loop bounce?

On 17 Oct 2013, at 12:34, Wietse Venema [via Postfix] [Masked] wrote: > > Preview: sendu: > > You mail is bounced because it contains a Delivere > Safely received through a Masked Email. IF THIS IS SPAM, CLICK HERE TO BLOCK > THIS MASKED EMAIL. > > sendu: > > > > You mail is bounced because i

Re: disable ipv6 when sending to gmail ?

Am 18.10.2013 17:57, schrieb Dominik George: > Mark Martinec schrieb: >> IMO, instead of working on workarounds, people's efforts would be >> better spent >> on setting up their DKIM and/or SPF, reverse DNS mapping, and making >> sure that >> postfix only binds to an intentionally configured IPv6

Re: Fwd: Question on postfix set up: stopping new connections from outside on smtp server

Viktor Dukhovni skrev den 2013-10-18 16:44: No, that also turns off SMTP for "LAN" clients. not if adding one more pr lan ip 192.168.0.1:smtpinet n - n -60 smtpd

THREAD CLOSED [Re: Question on postfix set up: stopping new connections from outside on smtp server]

On Fri, Oct 18, 2013 at 06:19:14PM +0200, Benny Pedersen wrote: > Viktor Dukhovni skrev den 2013-10-18 16:44: > > >No, that also turns off SMTP for "LAN" clients. > > not if adding one more pr lan ip > > 192.168.0.1:smtpinet n - n -60 smtpd This presumes a mach

Re: Timeout when delivering to large group of aliases

List: > I wanted to confirm the behavior we are experiencing at the moment when > delivering messages to addresses aliased to thousands of local users. > For example we have the address distgr...@domain.tld which is an alias > to 3000 local users. When our inbound spam filter connects to the

Re: Fwd: Question on postfix set up: stopping new connections from outside on smtp server

On Fri, Oct 18, 2013 at 12:35 PM, Viktor Dukhovni wrote: > On Fri, Oct 18, 2013 at 05:25:10PM +0200, Dominik George wrote: > >> >No, that also turns off SMTP for "LAN" clients. >> >> Then.. Put your LAN IP there :D. > > - Typically there is no LAN IP vs WAN IP for a machine that is not > dua

Re: What is causing this mail forwarding loop bounce?

On 18 Oct 2013, at 17:45, "Wietse Venema [Masked]" wrote: > Wietse: >> Does the Delivered-To: header already exist in the message? If that >> is the case, you have been forwarding mail back and forth between >> Postfix and some other server. That is a mail delivery loop. > > Sendu: >> Well not b

Re: What is causing this mail forwarding loop bounce?

Wietse: > Does the Delivered-To: header already exist in the message? If that > is the case, you have been forwarding mail back and forth between > Postfix and some other server. That is a mail delivery loop. Sendu: > Well not back and forth between my Postfix server. But in any case, > the mess

Re: Question on postfix set up: stopping new connections from outside on smtp server

On Fri, Oct 18, 2013 at 12:45 PM, Noel Jones wrote: > On 10/18/2013 8:00 AM, francis picabia wrote: >> Hello, >> >> I'm looking at the logs for an SMTP only service where iptables >> should be stopping new connections on port 25, and I'm >> seeing connects with no sasl auth. They fail to relay, b

Re: What is causing this mail forwarding loop bounce?

On Fri, Oct 18, 2013 at 09:03:47AM -0700, sendu wrote: > On 17 Oct 2013, at 12:34, Wietse Venema [via Postfix] [Masked] > wrote: > > sendu: > > > > > > You mail is bounced because it contains a Delivered-To: header > > > > with the address of the recipient. > > > > > > > > Postfix adds this h

Re: What is causing this mail forwarding loop bounce?

ecd60...@opayq.com: Sendu: > But in any case, the messages in Google's quarantine do indeed > already have the Delivered-To header prior to delivery. Wietse: > And what put that header in there? Sendu: > Google's spam system is adding the header. It is outside of my > control. If you are passing

Re: THREAD CLOSED [Re: Question on postfix set up: stopping new connections from outside on smtp server]

On Fri, Oct 18, 2013 at 1:35 PM, Viktor Dukhovni wrote: > On Fri, Oct 18, 2013 at 06:19:14PM +0200, Benny Pedersen wrote: > >> Viktor Dukhovni skrev den 2013-10-18 16:44: >> >> >No, that also turns off SMTP for "LAN" clients. >> >> not if adding one more pr lan ip >> >> 192.168.0.1:smtpinet n

Re: What is causing this mail forwarding loop bounce?

On 18 Oct 2013, at 18:18, "/dev/rob0 [via Postfix] [Masked]" wrote: > > > How do I turn off the D flag? > > What is this "D flag"? Perhaps you need to go back to the one who > made the suggestion to you. It was a tech support person quoting the man page for pipe. > I would suggest that yo

Re: What is causing this mail forwarding loop bounce?

On 18 Oct 2013, at 18:29, "Wietse Venema [via Postfix] [Masked]" wrote: > > > At this point I don't care about absolute correctness. I just want > > to receive my email. > > > > How do I disable the D flag? > > The D flag exists only in the pipe(8) daemon and ADDS delivered-to > headers.

Re: Question on postfix set up: stopping new connections from outside on smtp server

OK, with the syslog entry Noel suggested, I can see traffic has arrived on submission port. Yet if I grep for the IP connecting, I see no sasl login. Oct 18 14:39:24 myserver postfix-internal/submission/smtpd[25329]: connect from blk-222-132-252.eastlink.ca[24.222.132.252] Oct 18 14:39:24 myserve

Re: "not stopping" new connections from outside on smtp server

On Fri, Oct 18, 2013 at 01:38:22PM -0300, francis picabia wrote: > > - There are no Postfix issues here. The OP is looking for help > > with iptables. > > No, I posted here to ask about the postfix config. There are other places > I would ask about iptables. I was suspecting something misconfi

Re: Question on postfix set up: stopping new connections from outside on smtp server

Am 18.10.2013 19:48, schrieb francis picabia: > OK, with the syslog entry Noel suggested, I can see traffic has arrived on > submission port. Yet if I grep for the IP connecting, I see no sasl login. > > Oct 18 14:39:24 myserver postfix-internal/submission/smtpd[25329]: > connect from blk-222-1

Re: What is causing this mail forwarding loop bounce?

sendu: > On 18 Oct 2013, at 18:29, "Wietse Venema [via Postfix] [Masked]" > wrote: > > > > > At this point I don't care about absolute correctness. I just want > > > to receive my email. > > > > > > How do I disable the D flag? > > > > The D flag exists only in the pipe(8) daemon and ADDS d

Re: Question on postfix set up: stopping new connections from outside on smtp server

On Fri, Oct 18, 2013 at 02:48:55PM -0300, francis picabia wrote: > OK, with the syslog entry Noel suggested, I can see traffic has arrived on > submission port. Yet if I grep for the IP connecting, I see no sasl login. > > Oct 18 14:39:24 myserver postfix-internal/submission/smtpd[25329]: > conn

Re: Question on postfix set up: stopping new connections from outside on smtp server

On 10/18/2013 12:14 PM, francis picabia wrote: > I did have some PERMIT lines in /etc/postfix-internal/recipient_access > which didn't belong there. However, with all PERMIT cases removed > and postmap run on the file, I see a new log entry of "Relay access denied" "Relay access denied" is the re

Re: Question on postfix set up: stopping new connections from outside on smtp server

I had imagined sasl authentication would have to be resolved before the smtpd process would be taking commands and responding. I was thinking of how postscreen and postscreen_dnsbl_sites are handled. I've adjusted the picture. I like the suggestion to make it into "access denied", as this is more

Re: Question on postfix set up: stopping new connections from outside on smtp server

On Fri, Oct 18, 2013 at 01:24:09PM -0500, Noel Jones wrote: > > smtpd_recipient_restrictions = reject_unlisted_recipient, > > reject_unknown_recipient_domain, check_recipient_access > > hash:/etc/postfix-internal/recipient_access, > > permit_sasl_authenticated, permit_mynetworks, reject > > The o

Re: Question on postfix set up: stopping new connections from outside on smtp server

On 10/18/2013 1:47 PM, Viktor Dukhovni wrote: > On Fri, Oct 18, 2013 at 01:24:09PM -0500, Noel Jones wrote: > >>> smtpd_recipient_restrictions = reject_unlisted_recipient, >>> reject_unknown_recipient_domain, check_recipient_access >>> hash:/etc/postfix-internal/recipient_access, >>> permit_sasl_a

Re: Question on postfix set up: stopping new connections from outside on smtp server

Noel Jones: > On 10/18/2013 1:47 PM, Viktor Dukhovni wrote: > > On Fri, Oct 18, 2013 at 01:24:09PM -0500, Noel Jones wrote: > > > >>> smtpd_recipient_restrictions = reject_unlisted_recipient, > >>> reject_unknown_recipient_domain, check_recipient_access > >>> hash:/etc/postfix-internal/recipient_a

mxbackup quote

howdy I configurated postfix ad mxbackup. show set a quote forma each domain? thanks

Re: mxbackup quote

Am 18.10.2013 21:27, schrieb Pol Hallen: > I configurated postfix ad mxbackup. show set a quote forma each domain? *what* are you talking about? that pretty much makes no sense for anybody but you

Re: mxbackup quote

> > > Am 18.10.2013 21:27, schrieb Pol Hallen: >> I configurated postfix ad mxbackup. show set a quote forma each domain? > > *what* are you talking about? > that pretty much makes no sense for anybody but you > sorry for mistake (incorrect tablet language). I configurated postfix as mx-backup. N

Re: mxbackup quote

* Pol Hallen : > > > > > > Am 18.10.2013 21:27, schrieb Pol Hallen: > >> I configurated postfix ad mxbackup. show set a quote forma each domain? > > > > *what* are you talking about? > > that pretty much makes no sense for anybody but you > > sorry for mistake (incorrect tablet language). I config

Re: mxbackup quote

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Patrick Ben Koetter schrieb: >* Pol Hallen : >> > >> > >> > Am 18.10.2013 21:27, schrieb Pol Hallen: >> >> I configurated postfix ad mxbackup. show set a quote forma each >domain? >> > >> > *what* are you talking about? >> > that pretty much makes

Re: mxbackup quote

> Which kind of quota? Mailbox volume? Mail volume send quota? ...? for mail volume send quota. I didn't found anything searching online thanks > As a basic principle: Postfix routes and filters message transport, but it > doesn't deal with the details of mailbox management etc. > > p@rick > >

Re: mxbackup quote

On 10/18/2013 3:17 PM, Dominik George wrote: > Patrick Ben Koetter schrieb: >> As a basic principle: Postfix routes and filters message transport, but >> it >> doesn't deal with the details of mailbox management etc. > Huh? > > http://www.postfix.org/postconf.5.html#mailbox_size_limit Surely y

Re: mxbackup quote

* Pol Hallen : > > Which kind of quota? Mailbox volume? Mail volume send quota? ...? > > for mail volume send quota. I didn't found anything searching online Take a look at policyd . At least version 1 was/is able to do traffic limiting per domain/user. p@rick -- [*]

sign auto-reply vacation with OpenDKIM

Hi, in MILTER_README : "Postfix currently does not apply content filters to mail that is forwarded or aliased internally, or to mail that is generated internally such as bounces or Postmaster notifications. This may be a problem when you want to apply a signing Milter to such mail" So, can

Re: sign auto-reply vacation with OpenDKIM

On Fri, Oct 18, 2013 at 10:49:33PM +0200, Alexandre Ellert wrote: > "Postfix currently does not apply content filters to mail that is > forwarded or aliased internally, or to mail that is generated internally > such as bounces or Postmaster notifications. This may be a problem when > you want to a

Re: Maildrop issues

On 18 October 2013 15:26, Viktor Dukhovni wrote: > On Fri, Oct 18, 2013 at 03:15:49PM +0100, Mark Berry wrote: > > > However at other times they can take 30 minutes or more to all go. > > Slow cleanup(8) processing or disk I/O contention. Another > possibility is a syslog daemon configured to do

Re: postfix reports no rDNS on a host with many PTR records

Leonardo Rodrigues wrote the following on 10/17/2013 2:04 PM: Em 17/10/13 15:09, Blake Hudson escreveu: Based on your suggestion, I did find the following bug report for glibc from 2008 (that looks like Wietse had an indirect hand in): http://sourceware.org/bugzilla/show_bug.cgi?id=5790 It

Re: Maildrop issues

On 18 October 2013 16:20, Wietse Venema wrote: > Viktor Dukhovni: > > On Fri, Oct 18, 2013 at 03:15:49PM +0100, Mark Berry wrote: > > > > > However at other times they can take 30 minutes or more to all go. > > > > Slow cleanup(8) processing or disk I/O contention. Another > > possibility is a s

Re: disable ipv6 when sending to gmail ?

Hi, > what about giving the real IP and output of "ifconfig" to give others > the chance to verify this for you instead say "i took care" ok, here we go: > * sender address Dominik George > * configuration alias_database = hash:/etc/aliases alias_maps = ldap:/etc/postfix/ldap-group-aliases.c

Re: disable ipv6 when sending to gmail ?

Am 18.10.2013 23:52, schrieb Dominik George: > $ host 2a00:1828:2000:239::2 > 2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.3.2.0.0.0.0.2.8.2.8.1.0.0.a.2.ip6.arpa > domain name pointer shore.naturalnet.de. > > $ host shore.naturalnet.de > shore.naturalnet.de has address 89.238.64.147 > shore.naturalnet.de h

Re: disable ipv6 when sending to gmail ?

Hi, > if i would be you i would *not* use "v=spf1 mx ~all" If I were [...] ... > here you go for ipv6 > > http://www.openspf.org/SPF_Record_Syntax#ip6 Jeez, I don't believe it. The problem is that the mx mechanism simply only enumerates A records of MXs. That's broken ... Thanks for the point

Re: disable ipv6 when sending to gmail ?

Dominik George: > > > > http://www.openspf.org/SPF_Record_Syntax#ip6 > > Jeez, I don't believe it. The problem is that the mx mechanism simply > only enumerates A records of MXs. That's broken ... That's retarded. I wonder how many sites have been bitten by that bug. > Thanks for the pointer to

Re: sign auto-reply vacation with OpenDKIM

* Viktor Dukhovni : > On Fri, Oct 18, 2013 at 10:49:33PM +0200, Alexandre Ellert wrote: > > > "Postfix currently does not apply content filters to mail that is > > forwarded or aliased internally, or to mail that is generated internally > > such as bounces or Postmaster notifications. This may be

Re: disable ipv6 when sending to gmail ?

On Oct 19, 2013, at 00:13, Dominik George wrote: >> if i would be you i would *not* use "v=spf1 mx ~all" > > If I were [...] ... > >> here you go for ipv6 >> >> http://www.openspf.org/SPF_Record_Syntax#ip6 > > Jeez, I don't believe it. The problem is that the mx mechanism simply > only enumer