>I'd like to use this, but got hurt by
>reject_unknown_client
how so? I haven't really heard anybody complaining about it.
>and some others that are DNS based checks.
also, "reject unknown sender.domain" is very effective and has very few
false positives.
>What I can get away with is blocking all of China & Korea, etc, but not the
>very poorly admin'd non-profits.
>They are the bunches that we communicate with over healthcare matters
>routinely.
whitelists work
>Should I be worried?
I don't think so
>Slip it in on a weekend, and see if anyone is hollering by Tuesday or
>Wednesday???
>
>Any thoughts/cautions are appreciated..
you already have your nice little script that reports to/from addresses of
rejects. a good tool, use to what these kinds of rejects, too. white_list
as needed.
this is not a DNS check.
postfix gets a msg from [EMAIL PROTECTED], and tries to send from
postmaster@imgatebox to [EMAIL PROTECTED] if earthlink (exists
and) says "unknown user firemann816", the postfix rejects the msg from
firemann816.
Today, I convinced two fairly high volume, badly hammered ISP's I work with
to let me implement reject_verified_sender. So far, after 1000's of new
rejects with this filter, neither is screaming about false positives,
and the results are extremely encouraging (even without harvesting the
rejects for ip's and sender.domain).
sidepoint: what's amazing is how varied are the profiles of abuse different
ISP's see, and that's confirmed with the following two spam-stats reports
for these two test ISP's of mine:
ISP A:
1 ETRN Mail theft attempt
15 DNS no A/MX for @recipient.domain
16 Other
17 SMTP invalid [EMAIL PROTECTED]
42 SMTP invalid [EMAIL PROTECTED]
53 ACL [EMAIL PROTECTED]
55 ACL unauthorized relay
93 SMTP Exceeded Hard Error Limit after DATA
184 ACL helo_hostnames
199 ACL mta_clients_bw
626 ACL body checks
726 ACL from_senders_clueless
824 DNS no A/MX for @sender.domain
1032 ACL unverified sender address: verification in progress
1493 SMTP Exceeded Hard Error Limit after RCPT
1953 ACL mta_header_checks
2033 DNS timeout for MTA PTR hostname (forged @sender.domain)
2492 ACL from_senders_slet
2976 ACL undeliverable sender address: definitive <<<<<<
3656 DNS nxdomain for MTA PTR hostname (forged @sender.domain)
4478 ACL from_senders_black
5298 ACL unverified sender address: definitive <<<<<<<<<
7796 ACL from_senders_regexp
9433 ACL mta_clients_black
========================================
45491 TOTAL
.... for about 9 hours of operation with reject_unverified_sender.
And ISP B:
2 ETRN Mail theft attempt
2 SMTP Exceeded Hard Error Limit after MAIL
26 SMTP invalid [EMAIL PROTECTED]
27 ACL mta_clients_slet
40 SMTP invalid [EMAIL PROTECTED]
52 ACL body checks
67 ACL helo_hostnames
79 ACL mta_clients_onedict
83 SMTP Exceeded Hard Error Limit after CONNECT
126 ACL mta_clients_relay
157 ACL from_senders_clueless
159 ACL unauthorized relay
222 SMTP unauthorized pipelining
231 ACL mta_clients_dict
337 ACL from_senders_black
394 ACL header checks
434 ACL unverified sender address: verification in progress
558 ACL from_senders_nxdomain
955 SMTP Exceeded Hard Error Limit after DATA
982 ACL mta_clients_hel
1374 ACL unverified sender address: definitive <<<<<
1528 ACL mta_clients_senders_regexp
2905 ACL undeliverable sender address: definitive <<<<<
3053 DNS timeout for MTA PTR hostname (forged @sender.domain)
3283 ACL mta_clients_bw
5781 ACL mta_clients_blaksender
5965 ACL mta_clients_dead
6936 DNS no A/MX for @sender.domain
8116 ACL from_senders_regexp
9318 ACL mta_clients_bogus
10340 ACL mta_clients_black
21541 ACL from_senders_slet
22646 DNS nxdomain for MTA PTR hostname (forged @sender.domain)
47865 ACL to_recipients_xxnet unknown user
51220 SMTP Exceeded Hard Error Limit after RCPT
51854 ACL to_recipients_repexp
==========================================
258658 TOTAL
... for about 4 hours operation with reject_unverified_sender
AND!! a key point is that the above rejects are at the tail end of all
other smtpd_* restrictions, so these 1000's of msgs really would have
slipped through IMGate.
Nor am I hearing any complaining on the postfix list about this new feature.
Implementing reject_unverified_sender does mean upping postfix to the
"trace" version, which entails upping pflogsumm to match the new logging
formats, which entails adding 2 or 3 PERL modules.
but the results above are easily worth it, afaics today.
Len
