OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Sender access restrictions by connecting back to the MX/A server(s)

From: Michael Tokarev (mjttls.msk.ru)
Date: Thu Oct 02 2003 - 03:53:54 CDT


Guido Van De Velde wrote:
> I understand this can all be true, but I do not agree completely. There
> are several circumstances where the mx of a from-address is not
> available at the time of sending the message.

If your MX is not available at the time you send a mail out, receiving
host will tell your sending server to defer message, to be delivered
later - in a hope that next time delivery will be attempted, your MX
will be available. All mailservers have ability to queue messages.

An MX should generally be available, not down, or else you will have
problems receiving mails.

[]
> If you have two smtp-servers in cascade (for whatever reason), the first
> to accept from the Internet and to relay to the second, the second to
> send to the Internet and to relay to the local mailboxes, the first will
> be contacted by this external isp, but it doesn't know if an
> emailaddress really exists, because that's knowledge only the second one
> has. It can only confirm what the external smtp-server knows through a
> "reject_unknown_sender_domain" and a "reject_non_fqdn_sender".

In this case it is best to teach your secondary MX about a list of
valid addresses. Just because there are many spammers out there who
tries to send their junk to random addresses in existing domains.
Use relay_recipient_maps for this.

[]
> A regular mail with from like guidoNOSPAM.org to my home-mailbox is
> bounced/refused, but a flame I send with a from=wietsporcupine.org is
> accepted ??? Is that what we want ?

No, definitely. But this is a bit different story (using forged but
existing addresses, that is).

/mjt