On 3/5/2011 7:06 PM, Carlos Carvalho wrote:
Wietse Venema ([email protected]) wrote on 5 March 2011 17:22:
>Noel Jones:
>> On 3/5/2011 12:58 PM, Carlos Carvalho wrote:
>> > Noel Jones ([email protected]) wrote on 5 March 2011 12:30:
>> >
>> > Ops, my fault :-( I had put !.my.domain instead of !192.168.0.0/16 in
>> > the last edition of main.cf. It's working fine now, thanks a lot.
>> >
>> > >BTW, better to match the allowed clients by IP rather than
>> > >hostname.
>> >
>> > It does seem to be necessary for the limited ones... The allowed ones
>> > are fine, putting the full allowed.my.domain in the exception list.
>>
>> As documented, smtpd_client_event_limit_exceptions does not do
>> subdomain matching,
>
>It does:
>
> Specify a list of network blocks, hostnames or .domain names
> (the initial dot causes the domain to match any name below it).
>
>But, I agree that address-based patterns are more dependable.
>DNS may fail, and network address ranges don't change often.
Even though it's working, I don't undestand two things. First, why the
static:all is necessary. The exception list is
allowed1
allowed2
!192.68.0.0/16
So external senders do match the !192 clause, which should be enough
to grant them the exception without the :all.
Second, numeric addresses are more reliable but dns is working here,
so the machine knows very well that they don't belong do .my.domain.
Therefore putting !.my.domain should work as well.
This is is not a regular expression table. !192.168.0.0/16 is
an exception meaning "ignore clients matching 192.168.0.0/16",
not a "does not equal" regexp. The static:all is required to
match all other addresses.
The !.example.com should also work, but the static:all is
still required after it; same reason as above.
I'm glad your DNS is working. What happens if it doesn't?
What if someone adds a new domain name? Future proof and
simplify by using IP addresses whenever you can.
-- Noel Jones
