Re: How to not reject valid MTAs for inconsistent forward/reverse DNS.

2010-01-18 Thread Jose-Marcio Martins da Cruz
LuKreme wrote: On Jan 17, 2010, at 17:27, Stan Hoeppner s...@hardwarefreak.com wrote: Then I'd surmise your experience is very limited. I have only been running a mailserver for 17 years or so. Almost the same... Join spam-l and ask this naked PTR question. You will be clued. What is

Rejecting an address with our MX

2010-01-18 Thread Frank Bonnet
Hello I wonder how to reject a particuliar address at MX machine actually I use : smtpd_sender_restrictions = \check_sender_access hash:/usr/local/etc/postfix/sender_access on the mailhub which is not Internet visible but I would like to reject with the MX machine to avoid transmission to the

Re: Successful Delivery Notification

2010-01-18 Thread Ansgar Wiechers
On 2010-01-17 Daniel L. Miller wrote: Other than scanning the logfiles, is there a way a service can receive notification of a successful delivery to a remote site? In other words, a trusted client submits mail for a remote site, Postfix connects and receives acknowledgement from the remote

Re: Rejecting an address with our MX

2010-01-18 Thread Ansgar Wiechers
On 2010-01-18 Frank Bonnet wrote: I wonder how to reject a particuliar address at MX machine actually I use : smtpd_sender_restrictions = \check_sender_access hash:/usr/local/etc/postfix/sender_access on the mailhub which is not Internet visible but I would like to reject with the MX

Re: Successful Delivery Notification

2010-01-18 Thread Ziroux
On 18/01/10 07:31, Daniel L. Miller wrote: Other than scanning the logfiles, is there a way a service can receive notification of a successful delivery to a remote site? In other words, a trusted client submits mail for a remote site, Postfix connects and receives acknowledgement from the

Re: Postfix sender reputation support in snapshot 20100117

2010-01-18 Thread Wietse Venema
Stefan Foerster: * Wietse Venema wie...@porcupine.org: This is implemented by specifying FILTER actions with empty next-hop destinations in access maps or header/body_checks, and by configuring in master.cf one Postfix SMTP client for each SMTP source IP address, where each client has its

Re: Successful Delivery Notification

2010-01-18 Thread Wietse Venema
Daniel L. Miller: Other than scanning the logfiles, is there a way a service can receive notification of a successful delivery to a remote site? In other words, a trusted client submits mail for a remote site, Postfix connects and receives acknowledgement from the remote site, and then

Re: Postfix sender reputation support in snapshot 20100117

2010-01-18 Thread Wietse Venema
Wietse Venema: Stefan Foerster: * Wietse Venema wie...@porcupine.org: This is implemented by specifying FILTER actions with empty next-hop destinations in access maps or header/body_checks, and by configuring in master.cf one Postfix SMTP client for each SMTP source IP address,

Re: OT: Alternative for Spamassassin

2010-01-18 Thread Steve
Original-Nachricht Datum: Sun, 17 Jan 2010 19:49:49 +0100 Von: Michael Reck sir...@brauchmer.net An: postfix-users@postfix.org Betreff: OT: Alternative for Spamassassin Hi List, I`m looking for a SA replacement in an large scale enviroment. DSPAM seems to use

Re: OT: Alternative for Spamassassin

2010-01-18 Thread Michael Reck
Zitat von Patrick Ben Koetter p...@state-of-mind.de: * Michael Reck sir...@brauchmer.net: Hi List, I`m looking for a SA replacement in an large scale enviroment. DSPAM seems to use filesystem (--with-userdir=) for various functions which is not what i want. dspam also needs per user

Re: OT: Alternative for Spamassassin

2010-01-18 Thread Michael Reck
Zitat von Steve stev...@gmx.net: Original-Nachricht Datum: Sun, 17 Jan 2010 19:49:49 +0100 Von: Michael Reck sir...@brauchmer.net An: postfix-users@postfix.org Betreff: OT: Alternative for Spamassassin Hi List, I`m looking for a SA replacement in an large scale

Re: The method behind the madness

2010-01-18 Thread Sahil Tandon
On Sun, 17 Jan 2010, Daniel L. Miller wrote: The goal is simple - there are some people businesses my company needs to correspond with no matter how strict my filter, and no matter how badly the remote site is configured. Waiting to receive a message carrying critical business information

Re: The method behind the madness

2010-01-18 Thread Henrik K
On Sun, Jan 17, 2010 at 10:44:48PM -0800, Daniel L. Miller wrote: Daily scanning of logfiles does not accomplish this. Nor would even an hourly scan - and constant logfile scanning strikes me as inelegant. If there is any method currently existing within Postfix to accomplish this

Re: Convert _ to + on inbound addresses

2010-01-18 Thread Charles Boling
with SQL, there is no need to use pcre. just do that in the SQL query to avoid having to keep an external file up to date... ...except that the + (and everything between it and the @) is *not* actually part of the email address. To use your address as an example: When Postfix receives an

Re: The method behind the madness

2010-01-18 Thread Victor Duchovni
On Mon, Jan 18, 2010 at 07:01:45PM +0200, Henrik K wrote: I think I prefer a separate daemon that tails postfix log and greps all to=xxx, relay=xxx info and passes it to the policy daemon. That way the policy daemon doesn't need to have a big DNS mess to resolve all the recipient MX ips. MX

Re: How to not reject valid MTAs for inconsistent forward/reverse DNS.

2010-01-18 Thread Stan Hoeppner
LuKreme put forth on 1/18/2010 12:46 AM: On Jan 17, 2010, at 17:27, Stan Hoeppner s...@hardwarefreak.com wrote: Then I'd surmise your experience is very limited. I have only been running a mailserver for 17 years or so. Do you use either of these restrictions? reject_unknown_client_hostname

Re: Convert _ to + on inbound addresses

2010-01-18 Thread /dev/rob0
On Mon, Jan 18, 2010 at 09:12:00AM -0800, Charles Boling wrote: mouss: with SQL, there is no need to use pcre. just do that in the SQL query to avoid having to keep an external file up to date... ...except that the + (and everything between it and the @) is *not* actually part of the

Re: The method behind the madness

2010-01-18 Thread Wietse Venema
Victor Duchovni: On Mon, Jan 18, 2010 at 07:01:45PM +0200, Henrik K wrote: I think I prefer a separate daemon that tails postfix log and greps all to=xxx, relay=xxx info and passes it to the policy daemon. That way the policy daemon doesn't need to have a big DNS mess to resolve all the

Re: The method behind the madness

2010-01-18 Thread Daniel L. Miller
Henrik K wrote: On Sun, Jan 17, 2010 at 10:44:48PM -0800, Daniel L. Miller wrote: Daily scanning of logfiles does not accomplish this. Nor would even an hourly scan - and constant logfile scanning strikes me as inelegant. If there is any method currently existing within Postfix to

Re: The method behind the madness

2010-01-18 Thread Wietse Venema
Daniel L. Miller: Henrik K wrote: On Sun, Jan 17, 2010 at 10:44:48PM -0800, Daniel L. Miller wrote: Daily scanning of logfiles does not accomplish this. Nor would even an hourly scan - and constant logfile scanning strikes me as inelegant. If there is any method currently

Re: OT: Alternative for Spamassassin

2010-01-18 Thread Steve
Original-Nachricht Datum: Mon, 18 Jan 2010 16:40:40 +0100 Von: Michael Reck sir...@brauchmer.net An: postfix-users@postfix.org Betreff: Re: OT: Alternative for Spamassassin Zitat von Steve stev...@gmx.net: Original-Nachricht Datum: Sun, 17 Jan

Re: OT: Alternative for Spamassassin

2010-01-18 Thread /dev/rob0
On Mon, Jan 18, 2010 at 04:28:37PM +0100, Michael Reck wrote: Anyway, our customers complaining the usual way ( to much spam in my inbox...) and are not getting smarter (i don`t want to train SA...) so i must bear the challenge :) Such is the story with content filtering for spam control. It's

Re: The method behind the madness

2010-01-18 Thread Daniel L. Miller
Wietse Venema wrote: Daniel L. Miller: Henrik K wrote: On Sun, Jan 17, 2010 at 10:44:48PM -0800, Daniel L. Miller wrote: Daily scanning of logfiles does not accomplish this. Nor would even an hourly scan - and constant logfile scanning strikes me as inelegant. If there

Re: The method behind the madness

2010-01-18 Thread /dev/rob0
On Mon, Jan 18, 2010 at 10:14:34AM -0800, Daniel L. Miller wrote: But my primary issue is sender validation. I don't see how, currently, to implement this as a policy daemon without re-writing sender validation into the policy daemon. Right, IIUC what you're doing, you would have the policy

Re: The method behind the madness

2010-01-18 Thread Victor Duchovni
On Mon, Jan 18, 2010 at 10:14:34AM -0800, Daniel L. Miller wrote: But my primary issue is sender validation. I don't see how, currently, to implement this as a policy daemon without re-writing sender validation into the policy daemon. I don't see any way, for example, to call another

Re: The method behind the madness

2010-01-18 Thread Daniel L. Miller
/dev/rob0 wrote: On Mon, Jan 18, 2010 at 10:14:34AM -0800, Daniel L. Miller wrote: But my primary issue is sender validation. I don't see how, currently, to implement this as a policy daemon without re-writing sender validation into the policy daemon. Right, IIUC what you're doing,

Re: The method behind the madness

2010-01-18 Thread Daniel L. Miller
Victor Duchovni wrote: On Mon, Jan 18, 2010 at 10:14:34AM -0800, Daniel L. Miller wrote: But my primary issue is sender validation. I don't see how, currently, to implement this as a policy daemon without re-writing sender validation into the policy daemon. I don't see any way, for

Re: Rejecting an address with our MX

2010-01-18 Thread Stan Hoeppner
Frank Bonnet put forth on 1/18/2010 4:19 AM: Hello I wonder how to reject a particuliar address at MX machine actually I use : smtpd_sender_restrictions = \check_sender_access hash:/usr/local/etc/postfix/sender_access Do you want to reject an email address, or an IP address? If email

Re: The method behind the madness

2010-01-18 Thread Stan Hoeppner
Daniel L. Miller put forth on 1/18/2010 12:51 PM: A point - and a good one for initialization of the whitelist. However, this does not address the need to add new addresses to the list automatically. Example - our company changes insurance brokers, and needs to receive forms from the new

Re: The method behind the madness

2010-01-18 Thread Daniel L. Miller
Stan Hoeppner wrote: Daniel L. Miller put forth on 1/18/2010 12:51 PM: A point - and a good one for initialization of the whitelist. However, this does not address the need to add new addresses to the list automatically. Example - our company changes insurance brokers, and needs to

Re: The method behind the madness

2010-01-18 Thread Daniel L. Miller
Sahil Tandon wrote: On Sun, 17 Jan 2010, Daniel L. Miller wrote: The goal is simple - there are some people businesses my company needs to correspond with no matter how strict my filter, and no matter how badly the remote site is configured. Waiting to receive a message carrying critical

Re: How to not reject valid MTAs for inconsistent forward/reverse DNS.

2010-01-18 Thread LuKreme
On 18-Jan-2010, at 10:28, Stan Hoeppner wrote: LuKreme put forth on 1/18/2010 12:46 AM: On Jan 17, 2010, at 17:27, Stan Hoeppner s...@hardwarefreak.com wrote: Then I'd surmise your experience is very limited. I have only been running a mailserver for 17 years or so. Do you use either of

Re: The method behind the madness

2010-01-18 Thread Henrik K
On Mon, Jan 18, 2010 at 12:25:54PM -0500, Victor Duchovni wrote: On Mon, Jan 18, 2010 at 07:01:45PM +0200, Henrik K wrote: I think I prefer a separate daemon that tails postfix log and greps all to=xxx, relay=xxx info and passes it to the policy daemon. That way the policy daemon doesn't

Re: The method behind the madness

2010-01-18 Thread LuKreme
On 18-Jan-2010, at 11:37, Victor Duchovni wrote: This thread is NOT about address validation, it is about automatic whitelisting of addresses (as senders) that are observed in outgoing mail as recipients. No validation is required. This should be pretty easy to add into a greylisting service

Whitelisting made easy (was: The method behind the madness)

2010-01-18 Thread Wietse Venema
The following solution solves 99% of the problem: - IF mail is from a local (or authenticated) client - AND the sender has already passed reject_unlisted_sender - THEN store the (sender, recipient) pair in a whitelist. This can be done with trivial modification of an existing greylisting

WAS: The method behind the madness NOW: simple Postfix auto whitelist

2010-01-18 Thread Stan Hoeppner
Daniel L. Miller put forth on 1/18/2010 1:30 PM: If you _need_ a home brew solution _now_, start small and inelegant, getting most of the functionality you want/need. This can be done with simple scripts and cron. After it's working relatively well, _then_ spend time creating the elegant

Re: The method behind the madness

2010-01-18 Thread Steve
Original-Nachricht Datum: Mon, 18 Jan 2010 11:30:49 -0800 Von: Daniel L. Miller dmil...@amfes.com An: Postfix users postfix-users@postfix.org Betreff: Re: The method behind the madness Stan Hoeppner wrote: Daniel L. Miller put forth on 1/18/2010 12:51 PM: A

Re: The method behind the madness

2010-01-18 Thread Mark Nernberg (gmail account)
On Jan 18, 2010, at 17:05, Steve stev...@gmx.net wrote: Original-Nachricht Datum: Mon, 18 Jan 2010 11:30:49 -0800 Von: Daniel L. Miller dmil...@amfes.com An: Postfix users postfix-users@postfix.org Betreff: Re: The method behind the madness Stan Hoeppner wrote:

Re: The method behind the madness

2010-01-18 Thread Stan Hoeppner
Mark Nernberg (gmail account) put forth on 1/18/2010 4:17 PM: I have achieved this with a slightly hacked TMDA (www.tmda.net). if you want my modifications, contact me off-list. I'm surprised you actually mentioned a solution whose core feature is challenge/response. C/R is one of those cures

Re: The method behind the madness

2010-01-18 Thread Mark Nernberg (gmail account)
On Jan 18, 2010, at 17:48, Stan Hoeppner s...@hardwarefreak.com wrote: Mark Nernberg (gmail account) put forth on 1/18/2010 4:17 PM: I have achieved this with a slightly hacked TMDA (www.tmda.net). if you want my modifications, contact me off-list. I'm surprised you actually mentioned a

Re: The method behind the madness

2010-01-18 Thread Stan Hoeppner
Mark Nernberg (gmail account) put forth on 1/18/2010 4:50 PM: On Jan 18, 2010, at 17:48, Stan Hoeppner s...@hardwarefreak.com wrote: Mark Nernberg (gmail account) put forth on 1/18/2010 4:17 PM: I have achieved this with a slightly hacked TMDA (www.tmda.net). if you want my

Re: The method behind the madness

2010-01-18 Thread Mark Nernberg (gmail account)
On Jan 18, 2010, at 18:30, Stan Hoeppner s...@hardwarefreak.com wrote: Mark Nernberg (gmail account) put forth on 1/18/2010 4:50 PM: On Jan 18, 2010, at 17:48, Stan Hoeppner s...@hardwarefreak.com wrote: Mark Nernberg (gmail account) put forth on 1/18/2010 4:17 PM: I have achieved

Re: The method behind the madness

2010-01-18 Thread Wietse Venema
Stan Hoeppner: [ Charset ISO-8859-1 unsupported, converting... ] Mark Nernberg (gmail account) put forth on 1/18/2010 4:50 PM: On Jan 18, 2010, at 17:48, Stan Hoeppner s...@hardwarefreak.com wrote: Mark Nernberg (gmail account) put forth on 1/18/2010 4:17 PM: I have achieved this

Re: The method behind the madness

2010-01-18 Thread Steve
Original-Nachricht Datum: Mon, 18 Jan 2010 17:17:43 -0500 Von: Mark Nernberg (gmail account) marknernb...@gmail.com An: Steve stev...@gmx.net CC: postfix-users@postfix.org postfix-users@postfix.org Betreff: Re: The method behind the madness On Jan 18, 2010, at

Re: The method behind the madness

2010-01-18 Thread Mark Nernberg (gmail account)
-- sent from my mobile phone On Jan 18, 2010, at 18:54, wie...@porcupine.org (Wietse Venema) wrote: Stan Hoeppner: [ Charset ISO-8859-1 unsupported, converting... ] Mark Nernberg (gmail account) put forth on 1/18/2010 4:50 PM: On Jan 18, 2010, at 17:48, Stan Hoeppner

Re: The method behind the madness

2010-01-18 Thread Steve
Original-Nachricht Datum: Mon, 18 Jan 2010 19:06:13 -0500 Von: Mark Nernberg (gmail account) marknernb...@gmail.com An: Postfix users postfix-users@postfix.org CC: Postfix users postfix-users@postfix.org Betreff: Re: The method behind the madness -- sent from my

Re: Convert _ to + on inbound addresses

2010-01-18 Thread mouss
Charles Boling a écrit : with SQL, there is no need to use pcre. just do that in the SQL query to avoid having to keep an external file up to date... ...except that the + (and everything between it and the @) is *not* actually part of the email address. of course the + is part of the email

Relay control based on IP/domain matching?

2010-01-18 Thread Trần Trọng Tấn
Dear all, Do you have any way to check domain of email and IP of sending host before relay it? I'm trying to setup a gateway which accept relay for some IP address, and make sure this IP can only send email from domain(s) it owned. TIA, giobuon

Re: Relay control based on IP/domain matching?

2010-01-18 Thread Victor Duchovni
On Tue, Jan 19, 2010 at 09:56:46AM +0700, Tr???n Tr???ng T???n wrote: Do you have any way to check domain of email and IP of sending host before relay it? I'm trying to setup a gateway which accept relay for some IP address, and make sure this IP can only send email from domain(s) it owned.

suppress NDRs from spoofed sender

2010-01-18 Thread David Koski
My mail server has been getting a fair amount of spam hits that have been rejected but the sender address is spoofed with the recipient's address. This generates an NDR to the recipient with the spam. I would like to suppress NDRs of this kind but not legitimate NDRs. Regards, David Koski

How to block particular outgoing mails through postfix

2010-01-18 Thread J. Bakshi
Dear list, I am trying to drop outgoing emails having particular email-id in its [TO] field. Say myn...@domain1.com and myna...@domain2.com, hence any mail destined for myn...@domain1.com or myna...@domain2.com will be dropped . To achieve this I have made a file sender_reject with

Re: Relay control based on IP/domain matching?

2010-01-18 Thread ram
On Tue, 2010-01-19 at 09:56 +0700, Trần Trọng Tấn wrote: Dear all, Do you have any way to check domain of email and IP of sending host before relay it? I'm trying to setup a gateway which accept relay for some IP address, and make sure this IP can only send email from domain(s) it owned.