Thank you to Wietse and Viktor for the replies. Appreciate explanations very much.
> On Sunday, November 17, 2013 4:42 PM, Viktor Dukhovni > <[email protected]> wrote: > > On Sun, Nov 17, 2013 at 07:34:47PM -0500, Wietse Venema wrote: > > >> > I wanted to allow certain clients to relay by using a > check_client_access >> > lookup map. It works nice if I use IP addresses. If I use domain > names, >> > it stops working for my test environment. My test client doesn't > have >> > rDNS set up (I think this is the cause of "connect from >> > unknown[x.x.x.x]", right?). >> > >> > Do the check_client_access domain checks require rDNS? >> >> Any decision based on SMTP client hostname requires either an entry >> entry in /etc/hosts or equivalent, or a PTR record in DNS. > > And with DNS lookups, there is always the possibility of temporary > lookup failures leading to the client being unknown now and then. > > This is fine when rejecting unknown clients because the rejection > will be a temporary failure. It is not fine when whitelisting > clients by their DNS name, since in that case they may be hard-rejected > by later restrictions. > > The problem is unavoidable. Do not rely on whitelists that use > names obtained via DNS. > > -- > Viktor. >
