On Sun, Nov 17, 2013 at 07:34:47PM -0500, Wietse Venema wrote:
> > I wanted to allow certain clients to relay by using a check_client_access
> > lookup map. It works nice if I use IP addresses. If I use domain names,
> > it stops working for my test environment. My test client doesn't have
> > rDNS set up (I think this is the cause of "connect from
> > unknown[x.x.x.x]", right?).
> >
> > Do the check_client_access domain checks require rDNS?
>
> Any decision based on SMTP client hostname requires either an entry
> entry in /etc/hosts or equivalent, or a PTR record in DNS.
And with DNS lookups, there is always the possibility of temporary
lookup failures leading to the client being unknown now and then.
This is fine when rejecting unknown clients because the rejection
will be a temporary failure. It is not fine when whitelisting
clients by their DNS name, since in that case they may be hard-rejected
by later restrictions.
The problem is unavoidable. Do not rely on whitelists that use
names obtained via DNS.
--
Viktor.
