I'm following a discussion on another list regarding a Communigate gateway that is rejecting spoofed "MAIL FROM" before "RCPT TO" is received. I posted a sample SMTP exchange showing that Postfix rejects spoofed senders (via reject_unlisted_sender) after the "RCPT TO" stage:
220 mail.inetmsg.com - INetMsg ESMTP Mail Service - UCE Not Permitted! ehlo mail.test.net 250-mail.inetmsg.com 250-PIPELINING 250-SIZE 20480000 250-ETRN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN MAIL FROM: <bo...@inetmsg.com> 250 2.1.0 Ok RCPT TO: <b...@inetmsg.com> 550 5.1.0 <bo...@inetmsg.com>: Sender address rejected: User unknown quit 221 2.0.0 Bye Someone else posted the following to the list: "Communigate seems to be sending a 550 back after the MAIL FROM and then resets the state. This may cause problems with a lot of software that may always be expecting a 2xx response. Communigate is responding with a 5xx error after the MAIL FROM during the SMTP verification process. It shouldn’t do that. It should do that AFTER the RCPT TO like Postfix does. It should not 5xx the transaction until it has both parts." However, RFCs 2821 & 5321 seem to state that rejection after "MAIL TO" is valid and should be properly handled by the sending server. So my question is why does Postfix waits until after the "RCPT TO" phase before rejecting the sender address? Are there issue that can arise if the receiving server rejects the message immediately after "MAIL TO" rather then after "RCPT TO" is received? Thanks for any feedback and clarification. Bill
