OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: backup mx and with header checks

From: Noel Jones (njonesmegan.vbhcs.org)
Date: Mon Jun 15 2009 - 11:33:14 CDT


Terry L. Inzauro wrote:
> List,
>
> I operate a backup mx for one of my customers. In doing so, I have run into an issue where I must accept all email regardless
> of weather or not the messages is destined for a valid email account in my customers email system (which is MS Exchange 2003).
>
> I thought about asking my customer is they would export a list of email addresses for which they want backup MX service for
> so I can place that in a relay_recipient_map, but that process requires ongoing admin time and might not appeal to them.

If their system rejects unknown recipients during SMTP, you
can use the reject_unverified_recipient feature to let postfix
manage the valid recipient list for you.
Do this inside a check_recipient_access map to limit the
address probes to only this domain.
http://www.postfix.org/ADDRESS_VERIFICATION_README.html#recipient

> The majority of the junk mail I am seeing is in the form of From: userdomain and RCPT: userdomain which is obviously
> forged. Would a header_check be the way to go here in order to match and discard the junk mail in this case? If so, what
> would the pcre check look like?

header_checks examines one header at a time, so you can't
compare From: <> To:.
You can use a policy server such as postfwd to compare
envelope sender vs. recipient, or a content_filter such as
spamassassin to compare the headers.

> I understand that legitimate users wouldn't be able to send themselves email, but that fine with me.

   -- Noel Jones