[pfx] Re: DKIM and DMARC

2023-05-17 Thread Dominic Raferd via Postfix-users
On 17/05/2023 08:18, Matus UHLAR - fantomas via Postfix-users wrote: On 16.05.23 22:11, Tom Reed via Postfix-users wrote: For OpenDMARC this setting: SPFSelfValidate true this only causes opendmarc to resolve SPF itself instead of using existing Authentication-Results: header. Actually (from

Re: How do check DKIM and SPF on incoming email?

2022-11-20 Thread Dominic Raferd
On 16/11/2022 11:45, Matus UHLAR - fantomas wrote: I use: spf-milter (the same source as policyd-spf-python) opendkim openarc opendmarc so far in soft mode (no rejections) opendmarc can use results of previous three in its decisions. Does spf-milter have the same source as policyd-spf-python?

Re: started getting 550 #5.7.1 SPF unauthorized mail

2022-10-26 Thread Dominic Raferd
On 25/08/2022 04:41, li...@sbt.net.au wrote: I have a simple 'mail list' where an alias 'ct...@sbt.net.au' sends email to several recipients, that's been in use since long time. today noticed one of these addresses started bouncing with '5.7.1 SPF unauthorized mail' since just today: what am I

Re: dnswl.org lookup error

2022-05-08 Thread Dominic Raferd
On 08/05/2022 11:59, Byung-Hee HWANG wrote: Dear Bastian, Bastian Blank writes: Hi On Sun, May 08, 2022 at 07:42:00PM +0900, Byung-Hee HWANG wrote: May 8 10:24:25 bionic190316003 postfix/smtpd[10918]: warning: 17.188.51.209.list.dnswl.org: RBL lookup error: Host or domain name not found.

Re: Pre- or post-queue filter for authenticated submission

2022-04-13 Thread Dominic Raferd
On 13/04/2022 13:29, Jesper Dybdal wrote: I use amavisd-new for the smtpd instances that receive authenticated submission. Are there any significant pros and cons in doing this as a pre-queue filter (proxy) compared to doing it as a post-queue content filter? I suspect that it doesn't really

Re: Best way forwarding to Gmail

2022-04-06 Thread Dominic Raferd
On 06/04/2022 18:09, John Levine wrote: In my experience, forwarding to Gmail is an exercise in futility. I got lots of DMARC rejections of entirely legitimate mail that was only authenticated with SPF but had a strict DMARC policy, so Gmail rejected it. I too see this, but rarely.

Re: AW: Best way forwarding to Gmail

2022-04-06 Thread Dominic Raferd
On 06/04/2022 13:26, Byung-Hee HWANG wrote: "Ludi Cree" writes: (...thanks...) My advice is not to forward to GMail if you can not exclude spam. ^ This is a worthwhile answer for me, thanks! Agreed that first you must be

Re: postfix+amavis

2022-03-30 Thread Dominic Raferd
On 30/03/2022 15:14, natan wrote: Hi It is probably not for this group, but... Maybe someone has such a solution and can suggest? I have vuser and vdomain and my working environment (general scheme) : postfix+haproxy(external 2 x amavis) ... Spamassassin works

Re: milter_header_checks, pcre, chroot

2022-03-22 Thread Dominic Raferd
On 22/03/2022 16:40, Benny Pedersen wrote: OpenDMARC's internal SPF handling will be removed in a future version. Modern versions of openDMARC can and should be built with dependency on libspf2, so would never use the very old internal spf code, and instead use libspf2

Re: Trying to understand this DNSBL blocking issue

2022-03-06 Thread Dominic Raferd
On 05/03/2022 19:26, Gerben Wierda wrote: On 5 Mar 2022, at 18:23, Matus UHLAR - fantomas wrote: On 05.03.22 12:43, Gerben Wierda wrote: A forward zone without a forward address gives SERVFAIL But I was able to use forward-zone: name: "spamhaus.org" forward-addr:

Re: smtp; 552 5.3.4 Message size exceeds fixed limit

2022-02-09 Thread Dominic Raferd
On 09/02/2022 16:53, Gary Aitken wrote: Just got the message   smtp; 552 5.3.4 Message size exceeds fixed limit when attempting to receive a 7MB file: $ postconf -d | grep size_limit body_checks_size_limit = 51200 bounce_size_limit = 5 header_size_limit = 102400 mailbox_size_limit =

Re: multi instance and always_bcc

2022-01-10 Thread Dominic Raferd
My understanding is that always_bcc does not work: - if receive_override_options includes no_address_mappings; or - after Postfix has forwarded mail internally; or - for mails generated by Postfix itself On 10/01/2022 16:28, Zsombor B wrote: We'd like to debug some emails sent through a multi

Re: email from servers claiming to be ours

2021-11-16 Thread Dominic Raferd
On 16/11/2021 22:55, Ruben Safir wrote: I got an email from cpa...@mrbrklyn.com which is not from us, as we are mrbrklyn.com How do I block email with this on the From line From cpa...@mrbrklyn.com Tue Nov 16 03:59:34 2021 Return-Path: X-Original-To: ru...@mrbrklyn.com Delivered-To:

Re: domain email handled by postfix

2021-11-12 Thread Dominic Raferd
On 12/11/2021 04:53, Walt Pang wrote: How to set up postfix to forward all my domain's email to gmail, and enable authentication for SMTP outgoing messages? The good news is that we have had this working for our own domains for years. The bad news is that I don't have the time to explain our

Re: method to discard email with body containing gmail address

2021-11-08 Thread Dominic Raferd
On 08/11/2021 08:43, Ansgar Wiechers wrote: On 2021-11-06 Wietse Venema wrote: li...@lazygranch.com: Reply-To: jm84450...@gmail.com Use header_checks (not body_checks) if you want to block that. Still, I would be concerned about rejecting legitimate email. It's true that this can reject

Re: Rewrite subject for unauth messages only

2021-11-05 Thread Dominic Raferd
On 05/11/2021 10:20, Gionatan Danti wrote: Il 2021-11-05 09:36 Dominic Raferd ha scritto: Why permit auth connections on port 25? Restrict them to 587 and/or 465 then you can specify subject rewriting for (all) mails arriving via port 25.  (And you can use postscreen on port 25.) Yeah

Re: Rewrite subject for unauth messages only

2021-11-05 Thread Dominic Raferd
On 04/11/2021 21:51, Gionatan Danti wrote: Dear all, I was tasked to mark all messages coming from unauthenticated clients (ie: incoming emails) with a specific subject line. While subject rewrite is trivial per-se (via header_checks), I am having big issues rewriting only selected messages. I

Re: delete from hold queue

2021-10-28 Thread Dominic Raferd
On 29/10/2021 05:24, Viktor Dukhovni wrote: On Thu, Oct 28, 2021 at 10:14:15PM -0400, Viktor Dukhovni wrote: postqueue -j | jq -nr --argjson $days ' Correction, that first line should be: postqueue -j | jq -nr --argjson days $days ' Setting the "jq" variabe "$days" to the shell

Re: delete from hold queue

2021-10-28 Thread Dominic Raferd
BTW, I delete the hold queue once a day. But never mind, was just wondering if anybody had written such a script. #!/bin/bash # hold_deleter.sh v0.1 by Dominic Raferd [28 Oct 2021] find_program() { command -v "$1" || { echo "Cannot locate $1 program; aborted" >&2;

Re: SSL_accept error from unknown

2021-10-18 Thread Dominic Raferd
On 19/10/2021 05:59, Maurizio Caloro wrote: see today logs "SSL_accept Error", please its this a known issue? installed Postfix 3.4.14, Openssl 1.1.1d, Debian 10.11. Oct 19 05:59:18 nmail postfix/smtps/smtpd[32720]: SSL_accept error from 232.115.xx.xx.static.ip.windstream.net[40.138.xx.xx]:

Re: bizarre warning from postfix received

2021-08-25 Thread Dominic Raferd
On 25/08/2021 04:01, Jean-François Bachelet wrote: Hello ^^) In the today's report I've got from PFLogsumm about the Postfix activity from yesterday I have a warning that I see here : Aug 24 19:48:55 servername postfix/postfix-script[1187]: warning:

Re: Modifying subject for emails from external senders

2021-08-23 Thread Dominic Raferd
On 23/08/2021 14:02, Jens Hoffrichter wrote: Hi, I cannot find a previous discussion about this topic here on the mailing list. We are running postfix instances for a big corporation, which delivers to MS Exchange / Exchange online backends. We now have gotten the requirement to mark all

Re: Question on DKIM signature

2021-08-16 Thread Dominic Raferd
On 16/08/2021 10:21, Ken N wrote: I was reading this blog posting: https://www.alexblackie.com/articles/email-authenticity-dkim-spf-dmarc/ But I am confused that, what content should DKIM signature for? The message body or headers? what headers should be signed? The body is always included

Re: Best current practice to analyze brute force login attempts?

2021-07-30 Thread Dominic Raferd
On 30/07/2021 18:05, Wietse Venema wrote: Hadmut Danisch: Hi, we are experiencing permanent high traffic from numerous sites trying to smtp auth to our postfix node, obviously trying to brute force password dictionaries against mail address lists probably taken from spam lists (including lots

Re: Has rfc2487 been obsoleted and mandatory TLS in smtpd is now kosher?

2021-07-29 Thread Dominic Raferd
On 29/07/2021 17:24, Josh Good wrote: On 2021 Jul 29, 10:01, Viktor Dukhovni wrote: On 29 Jul 2021, at 8:17 am, raf wrote: The Rhenus email did say: "...must be sent with the TLS 1.2 protocol or higher. Any mail received without fulfilling this condition will be rejected by our

Re: Conditional milter_header_checks?

2021-07-14 Thread Dominic Raferd
On 14/07/2021 08:43, raf wrote: On Wed, Jul 14, 2021 at 02:38:00PM +1000, raf wrote: On Tue, Jul 13, 2021 at 06:06:16PM -0400, post...@ptld.com wrote: Viktor wrote: That's because DMARC (which I don't use or recommed) Why don't you recommend DMARC? What is wrong with it? Do you accept

Re: www.postfix.org site appears to be down.

2021-07-03 Thread Dominic Raferd
On 03/07/2021 07:48, @lbutlr wrote: When going to https://www.postfix.org I get, after an invalid certificate error,... The correct address is http://www.postfix.org (no https...)

Re: spamass.sock - No such file or directory

2021-06-26 Thread Dominic Raferd
Remove the slash after unix: On Sat, 26 Jun 2021, 08:38 , wrote: > Run with Debian 10 > > I dont see why “spamass.sock: No such file or directory” this message > appair > > > > >mail.log > > Jun 26 09:27:12 nmail postfix/smtps/smtpd[9509]: warning: connect to > Milter service

Re: REDIRECT overrides always_bcc

2021-06-15 Thread Dominic Raferd
On 20/04/2021 10:04, Matus UHLAR - fantomas wrote: On 2021-04-16 12:03, Dominic Raferd wrote: > I have started using a REDIRECT action in a header_checks table > which works but seems to prevent always_bcc from operating - > the email is not bcc'd. On Fri, 16 Apr 2021, 20:07 Rob McGe

Re: Unable to get Postfix to respond on port 465

2021-06-14 Thread Dominic Raferd
On 14/06/2021 15:51, Linda Pagillo wrote: Thanks everyone. I'm still at a loss here. I have tried everything you guys have suggested and it's also not a firewall issue so at this point I have no idea why I can't get this to work. Currently I have the following in my master.cf

Re: strange characters in log

2021-05-24 Thread Dominic Raferd
On 24/05/2021 11:01, Benny Pedersen wrote: On 2021-05-24 11:47, Dominic Raferd wrote: On 24/05/2021 10:33, Benny Pedersen wrote: On 2021-05-24 08:02, Dominic Raferd wrote: On 24/05/2021 02:10, Jim Popovitch wrote: On Mon, 2021-05-24 at 03:00 +0200, Fourhundred Thecat wrote: I see

Re: strange characters in log

2021-05-24 Thread Dominic Raferd
On 24/05/2021 10:33, Benny Pedersen wrote: On 2021-05-24 08:02, Dominic Raferd wrote: On 24/05/2021 02:10, Jim Popovitch wrote: On Mon, 2021-05-24 at 03:00 +0200, Fourhundred Thecat wrote: I see following lines in my log (pasted below). What do these errors mean? Is somebody sending garbage

Re: strange characters in log

2021-05-24 Thread Dominic Raferd
On 24/05/2021 02:10, Jim Popovitch wrote: On Mon, 2021-05-24 at 03:00 +0200, Fourhundred Thecat wrote: I see following lines in my log (pasted below). What do these errors mean? Is somebody sending garbage characters to my server? Same here May 24 00:25:11 mx2 postfix/trivial-rewrite[13453]:

Re: Block auth senders using other domains

2021-05-13 Thread Dominic Raferd
On 13/05/2021 16:12, Matus UHLAR - fantomas wrote: On 13.05.21 12:12, Dominic Raferd wrote: But it doesn't stop them sending from a different domain that is not listed in my virtual_alias_domains, such as f...@gmail.com. Currently I stop this with my own check_sender_access file (in an smtpd

Re: Block auth senders using other domains

2021-05-13 Thread Dominic Raferd
On 13/05/2021 12:26, Matus UHLAR - fantomas wrote: On 13.05.21 12:12, Dominic Raferd wrote: But it doesn't stop them sending from a different domain that is not listed in my virtual_alias_domains, such as f...@gmail.com. Currently I stop this with my own check_sender_access file (in an smtpd

Block auth senders using other domains

2021-05-13 Thread Dominic Raferd
My domains are listed in virtual_alias_domains and my legit senders/recipients in virtual_alias_maps. I recently discovered the 'reject_unlisted_sender' option which successfully prevents (auth) senders from sending from an unknown name@mydomain. For instance f...@timedicer.co.uk is blocked

Re: SPF/DMARC modified by host en route

2021-04-26 Thread Dominic Raferd
On 26/04/2021 13:31, Jeff Abrahamson wrote: On 26/04/2021 12:56, Dominic Raferd wrote: On 26/04/2021 10:16, Jeff Abrahamson wrote: I'm seeing a disturbing (but minority) number of hosts that class our mail is spam.  After some digging, I've found an interesting test case.  What I'm uncertain

Re: SPF/DMARC modified by host en route

2021-04-26 Thread Dominic Raferd
On 26/04/2021 10:16, Jeff Abrahamson wrote: I'm seeing a disturbing (but minority) number of hosts that class our mail is spam.  After some digging, I've found an interesting test case.  What I'm uncertain of is if this represents a config error on our side or a (grossly) misbehaving mail

Re: Configuring always_bcc

2021-04-21 Thread Dominic Raferd
On 21/04/2021 16:17, Alex wrote: I have postfix configured in a multi-instance setup in conjunction with amavisd. I'm using always_bcc to create a copy of each email sent or received. The problem is that, while postfix appears to deliver the bcc-user email separately from the other recipients,

Re: REDIRECT overrides always_bcc

2021-04-19 Thread Dominic Raferd
On Fri, 16 Apr 2021, 20:07 Rob McGee, wrote: > On 2021-04-16 12:03, Dominic Raferd wrote: > > I have started using a REDIRECT action in a header_checks table > > which works but seems to prevent always_bcc from operating - > > the email is not bcc'd. > > It's ugly

Re: REDIRECT overrides always_bcc

2021-04-16 Thread Dominic Raferd
On 16/04/2021 18:39, Wietse Venema wrote: Dominic Raferd: I have started using a REDIRECT action in a header_checks table which works but seems to prevent always_bcc from operating - the email is not bcc'd. REDIRECT is a blunt tool that ignores all recipients. If there are multiple redirect

REDIRECT overrides always_bcc

2021-04-16 Thread Dominic Raferd
I have started using a REDIRECT action in a header_checks table which works but seems to prevent always_bcc from operating - the email is not bcc'd. I tried adding a subsequent BCC action triggered by the same header text but it has no effect. I realise that this is consistent with

Re: opedmarc and opendkim

2021-03-31 Thread Dominic Raferd
On 31/03/2021 17:29, Benny Pedersen wrote: On 2021-03-31 18:21, Dan Mahoney wrote: problem is your setup used Sender-ID with is long time depricated Why would you advise not using libspf2? atleast not in opendmarc, sid-milter is imho fine but it bulds in both cases of depricated Sender-ID

Re: Backscatter problems + fixes + RFC idea

2021-03-23 Thread Dominic Raferd
On 20/03/2021 18:52, Rahul Dhesi wrote: On Sat, 20 Mar 2021, Dominic Raferd wrote: You may find my script helpful: https://www.timedicer.co.uk/programs/help/relay-enforcer.sh.php Looks very interesting, thanks. I ran 'shellcheck' on it and saw many scary warnings; highly recommended

Re: Backscatter problems + fixes + RFC idea

2021-03-20 Thread Dominic Raferd
On 20/03/2021 01:53, Rahul Dhesi wrote: On Fri, 19 Mar 2021, Wietse Venema wrote: See examples in: http://www.postfix.org/postconf.5.html#default_delivery_status_filter (this was originally designed to turn soft TLS errors into hard ones). Thanks, that is a vey nice feature I did not know

Re: k8s: auto reload after cert renewal

2021-03-19 Thread Dominic Raferd
On 19/03/2021 11:14, Leo Baltus wrote: Running postfix in k8s and using cert-manger to manage certificates it would be nice if postfix could pickup new certificates for long running processes like smtpd. Much like it picks up updated databases like those managed by postmap. I do not see any

Re: Error 4.4.2 Error: timeout exceeded

2021-03-18 Thread Dominic Raferd
On 18/03/2021 10:36, Burn Zero wrote: I have a relay server named smtprelayservername which accepts emails from various clients. So one of the clients complain that they receive this error while sending email: Error 4.4.2 Error: timeout exceeded But I have checked in the relay server

Re: Milter Behavior

2021-03-11 Thread Dominic Raferd
On 12/03/2021 02:35, Dan Mahoney wrote: On Mar 11, 2021, at 1:00 AM, Dominic Raferd <mailto:domi...@timedicer.co.uk>> wrote: This works for me: # grep ^RejectFailures /etc/opendmarc.conf # (note: false is the default anyway) RejectFailures false That’s orthogonal. RejectFail

Re: Milter Behavior

2021-03-11 Thread Dominic Raferd
On 10/03/2021 19:00, Dan Mahoney (Gushi) wrote: All, I'm working with the OpenDMARC folks on doing bug triage, and someone has requested that if a domain's policy says p=quarantine, that it should be "accepted" by postfix, and left for something like SpamAssassin to deal with.  (I don't see

Re: Using alternate identity

2021-03-05 Thread Dominic Raferd
On 05/03/2021 12:40, Peter White wrote: ...I tried using said alternate identity by using mutt an simply changing the "From" header. It kind of works but seems to leak my real email address, because the "Return-Path" still points to the main address. .. This is not a postfix issue. In .muttrc:

Re: How do I stop getting multiple copies of emails from "always_bcc" option?

2021-03-04 Thread Dominic Raferd
On 04/03/2021 11:42, Steve Dondley wrote: On 03.03.21 18:23, Steve Dondley wrote: I have enabled the always_bcc setting with: always_bcc = exam...@example.org It works, but I'm getting everything three times. How do I prevent duplicates? this can happen if you use content_filter that feeds

Re: empty pid files

2021-02-22 Thread Dominic Raferd
On 22/02/2021 14:07, Wietse Venema wrote: Dominic Raferd: I used to run postfix chrooted but no longer do so. |find /var/spool/postfix -type f -ls| shows a list of files in /var/spool/postfix/pid/ with names inet.* and unix.*, all very old and zero-length. Is this a hangover from running

Re: empty pid files

2021-02-22 Thread Dominic Raferd
On 22/02/2021 08:19, Dominic Raferd wrote: I used to run postfix chrooted but no longer do so. |find /var/spool/postfix -type f -ls| shows a list of files in /var/spool/postfix/pid/ with names inet.* and unix.*, all very old and zero-length. Is this a hangover from running postfix chrooted

empty pid files

2021-02-22 Thread Dominic Raferd
I used to run postfix chrooted but no longer do so. |find /var/spool/postfix -type f -ls| shows a list of files in /var/spool/postfix/pid/ with names inet.* and unix.*, all very old and zero-length. Is this a hangover from running postfix chrooted? Can I remove them all? It also shows a few

Re: SSL version question

2021-02-17 Thread Dominic Raferd
On 17/02/2021 14:49, Vincent Lefevre wrote: On 2021-02-16 18:34:32 -0200, Viktor Dukhovni wrote: On Feb 16, 2021, at 3:57 PM, Dominic Raferd wrote: In what way does that improve your security over the default, which allows 1.0 and 1.1? As stated this is for auth clients i.e. our own

Re: SSL version question

2021-02-16 Thread Dominic Raferd
On 16/02/2021 17:41, Bill Cole wrote: On 16 Feb 2021, at 5:46, Dominic Raferd wrote: On 16/02/2021 10:28, Jeff Abrahamson wrote: I have a client that's triggering these errors in my logs (and is therefore unable to send even though he can read mail ok): postfix/submission/smtpd[310140

Re: SSL version question

2021-02-16 Thread Dominic Raferd
On 16/02/2021 10:28, Jeff Abrahamson wrote: I have a client that's triggering these errors in my logs (and is therefore unable to send even though he can read mail ok): postfix/submission/smtpd[310140]: connect from [...] postfix/submission/smtpd[310140]: SSL_accept error from

Re: File-format for Included Files for main.cf Options

2021-02-13 Thread Dominic Raferd
On 12/02/2021 18:35, Chris Green wrote: On Fri, Feb 12, 2021 at 01:08:07PM -0500, Viktor Dukhovni wrote: On Fri, Feb 12, 2021 at 11:14:24AM +, Dominic Raferd wrote: On 12/01/2021 01:21, Viktor Dukhovni wrote: On Tue, Jan 12, 2021 at 01:00:26AM +, JL (Postfix Readers A/c) wrote

Re: File-format for Included Files for main.cf Options

2021-02-12 Thread Dominic Raferd
On 12/01/2021 01:21, Viktor Dukhovni wrote: On Tue, Jan 12, 2021 at 01:00:26AM +, JL (Postfix Readers A/c) wrote: Can someone point me at the right place in the docs, or offer advice which maybe could also be added to the docs (!) to help others? Each main.cf parameter documents its

Re: client and ehlo hostname mismatch

2021-02-11 Thread Dominic Raferd
On 11/02/2021 09:32, Eugene Podshivalov wrote: Is it safe enough nowadays to drop dmarc failed incoming mail with opendmarc? I would say not. I quarantine DMARC failures but do not reject - there are still fps because of misconfiguration by senders or mailing lists that are not

Re: Stucked with "unable to look up host"

2021-02-09 Thread Dominic Raferd
On 09/02/2021 12:36, @lbutlr wrote: On 09 Feb 2021, at 04:23, Dominic Raferd wrote: This shows plenty of 'good' servers still using TLSv1 or TLSv1.1 - including the postfix-users list servers. Of course they would probably downgrade to plaintext if required, but that would reduce security

Re: Stucked with "unable to look up host"

2021-02-09 Thread Dominic Raferd
On 09/02/2021 10:58, @lbutlr wrote: On 09 Feb 2021, at 03:53, @lbutlr wrote: Looking over the last few days, I see connections rom servers I do not accept mail from, so it looks to me based on my logs that I could easily reject TLSv1 or TLSv1.1 without missing a single mail. Meant to

Re: TCP wrappers and Postfix

2021-02-08 Thread Dominic Raferd
On 08/02/2021 08:04, Eugene Podshivalov wrote: There are a bunch of spiders and spammers nowadays which are knocking the service every hour or so every day. Postfix has a really powerful access control system to protect itself but it becomes a bit hard to read the log file flooded by the

Re: rejecting 'fancy' TLDs, allowing a specified one ?

2021-01-31 Thread Dominic Raferd
On 30/01/2021 20:22, Viktor Dukhovni wrote: On Sat, Jan 30, 2021 at 01:20:13PM -0500, Phil Stracchino wrote: I'm looking at implementing a rule to discard all four-letter-and-above TLDs except whitelisted ones, because I'm tired of playing whack-a-mole. I'd like to strongly advise against

Re: How do you manage the ‘hold’ queue?

2021-01-27 Thread Dominic Raferd
On 27/01/2021 13:47, David Bürgin wrote: Thanks everybody – I’ve decided that for me personally handling this is too much work, and I’ve disabled this particular milter. (There is an open issue in the OpenDMARC project that I have upvoted:

Re: trouble talking to NYC Government

2021-01-26 Thread Dominic Raferd
On 26/01/2021 15:46, Ruben Safir wrote: I am getting this strange rejections to talk to NYC government Final-Recipient: rfc822; cdeut...@council.nyc.gov Original-Recipient: rfc822;cdeut...@council.nyc.gov Action: delayed Status: 4.4.3 Diagnostic-Code: X-Postfix; delivery temporarily suspended:

Re: How do you manage the ‘hold’ queue?

2021-01-25 Thread Dominic Raferd
On 26/01/2021 07:13, David Bürgin wrote: I’ve recently begun using the ‘hold’ queue, because of a milter that I use. A milter may ‘quarantine’ a message, which causes the message to be placed in the ‘hold’ queue (eg OpenDMARC does this when the DMARC policy requests quarantine). But how does

Re: rejecting 'fancy' TLDs, allowing a specified one ?

2020-12-16 Thread Dominic Raferd
On 16/12/2020 11:07, li...@sbt.net.au wrote: I have a check to reject 'fancy TLDs' as below smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_sender_access pcre:/etc/postfix/sender_pcre, check_sender_access pcre:/etc/postfix/reject_domains cat

Re: 'Send only' postfix configuration works on Ubuntu but not on Rasberry Pi - missing TLS library?

2020-12-07 Thread Dominic Raferd
On 07/12/2020 14:58, Chris Green wrote: On Mon, Dec 07, 2020 at 02:34:14PM +, Dominic Raferd wrote: On 07/12/2020 13:11, Chris Green wrote: On Mon, Dec 07, 2020 at 01:01:16PM +, Chris Green wrote: [snip] While I'm about it why am I getting identical mail.log and mail.info files

Re: 'Send only' postfix configuration works on Ubuntu but not on Rasberry Pi - missing TLS library?

2020-12-07 Thread Dominic Raferd
On 07/12/2020 13:11, Chris Green wrote: On Mon, Dec 07, 2020 at 01:01:16PM +, Chris Green wrote: [snip] While I'm about it why am I getting identical mail.log and mail.info files created in /var/log on the Pi? I could still do with an answer to this. Check contents of /etc/rsyslog.d

Re: adding AV scanning to working Postfix/SA system

2020-11-23 Thread Dominic Raferd
On 23/11/2020 16:34, Joe Acquisto-j4 wrote: Not to waste anyone's time, but I posted this on SA list and a Sophos site, but, came up with zip. Not even a "do-dah". Beyond "experiences" any leads to general "how to: guides that work in practice? SOHO system, on virtual machines. Fairly

Re: Fwd: Verify Proper method for sender restrictions

2020-10-28 Thread Dominic Raferd
On 28/10/2020 15:53, Allen Coates wrote: On 28/10/2020 15:24, Viktor Dukhovni wrote: On Wed, Oct 28, 2020 at 09:05:40AM +, Allen Coates wrote: Some time ago (5 years maybe) I discovered that "OK" was not being universally recognised in every access list; I cultivated the habit of

Re: sanity-check postfix XCLIENT usage ?

2020-10-23 Thread Dominic Raferd
On 23/10/2020 09:27, Nick Tait wrote: On 22/10/20 6:13 am, PGNet Dev wrote: Before I take this up as an opendmarc question (my config &/or bug), & do more thorough digging re: intuit's published records, (1) Is there anything obviously wrong/missing in that^ XCLIENT usage generally, or in

Re: sanity-check postfix XCLIENT usage ?

2020-10-21 Thread Dominic Raferd
On 22/10/2020 00:39, PGNet Dev wrote: On 10/21/20 4:31 PM, Wietse Venema wrote: PGNet Dev: Two questions: clear. i'll focus just on just the dmarc bits. both debugging opendmarc, and replacing it with another option to see if behavior changes. xclient's extremely helpful in any case.

Re: rbl check debug

2020-10-17 Thread Dominic Raferd
On 16/10/2020 22:04, David Wells wrote: I have a postfix-3.3.2 installation (installed from source on slackware 14.2 from the slackbuilds package) that does rbl checks in the smtpd_recipient_restrictions section. I have been seeing an increasing amount of spam coming in so I added more

Re: repeated connect and disconnect

2020-10-08 Thread Dominic Raferd
On Thu, 8 Oct 2020 at 04:03, li...@lazygranch.com wrote: > > Is there something I should be doing to mitigate this problem? > > Oct 8 02:11:42 myserver postfix/smtpd[11630]: connect from > unknown[180.123.163.212] > Oct 8 02:11:43 myserver postfix/smtpd[11632]: connect from >

Re: Reverse smtpd_sender_login_maps

2020-10-07 Thread Dominic Raferd
On Wed, 7 Oct 2020 at 14:04, Vieri Di Paola wrote: > > On Wed, Oct 7, 2020 at 2:34 PM Tom Sommer wrote: > > > > So SASL user "t...@example.com" would be able to send only from > > "@example.com". > > smtpd_sender_login_maps = pcre:/etc/postfix/login_maps.pcre > > content of

Re: How to allow relaying per domain?

2020-09-28 Thread Dominic Raferd
What about having multiple different smtpd services on different ports; then set up the LAN mail agents to send to whichever port is appropriate for their access, and you can have entirely bespoke settings for each one. On Mon, 28 Sep 2020 at 10:02, Hans van Zijst wrote: > > Hi Nick, > > Thanks

Re: smtpd_tls_CApath etc - needed?

2020-09-24 Thread Dominic Raferd
On Thu, 24 Sep 2020 at 09:12, Viktor Dukhovni wrote: > > On Wed, Sep 23, 2020 at 09:48:28AM +0100, Dominic Raferd wrote: > > > My mail servers, with LetsEncrypt certificates, seem to be working > > perfectly (sending to, and receiving from, the world), but I h

smtpd_tls_CApath etc - needed?

2020-09-23 Thread Dominic Raferd
My mail servers, with LetsEncrypt certificates, seem to be working perfectly (sending to, and receiving from, the world), but I have never set any of: smtp_tls_CAfile smtp_tls_CApath smtpd_tls_CAfile smtpd_tls_CApath tls_append_default_CA Should I be setting any of these?

Re: Being blocked with error 554 5.7.1

2020-09-15 Thread Dominic Raferd
iveness of the spam filtering but it seems like > a setting that wouldn't be commonly used as Google's defaults are > usually pretty good and we don't tend to get rejected in daily use. > > > On 12/09/2020 14:53, Dominic Raferd wrote: > > Just after I sent my reply to your

Re: Forward mail and obey SPF and DKIM

2020-09-14 Thread Dominic Raferd
On 14/09/2020 15:09, IL Ka wrote: On Mon, Sep 14, 2020 at 4:53 PM Dominic Raferd mailto:domi...@timedicer.co.uk>> wrote: On 14/09/2020 14:31, IL Ka wrote: > Hello. > I have postfix running on linux box. > > I setup OpenDKIM with both smtpd and non_smtp mil

Re: Forward mail and obey SPF and DKIM

2020-09-14 Thread Dominic Raferd
On 14/09/2020 14:31, IL Ka wrote: Hello. I have postfix running on linux box. I setup OpenDKIM with both smtpd and non_smtp milters. I also set my address in DNS as permitted IP for SPF. So far, so good. But I want all my mail to be forwarded to gmail. Some user sends me email from

Re: spam uses my email address as sender in "header from"

2020-09-14 Thread Dominic Raferd
On 14/09/2020 11:35, Fourhundred Thecat wrote: I am receiving spam, where the "header from" is my actual email (ie, the email that this spam is delivered to) The "envelope from" that I see in postfix logs is some random email. What mechanisms are there to reject such messages, which use my

Re: Being blocked with error 554 5.7.1

2020-09-12 Thread Dominic Raferd
on.' You can read what Google say at that link. There is nothing in your email that looks at all like spam to me. Are you able to fix the DMARC entry in your DNS? It has spurious escaped quotes. On Sat, 12 Sep 2020 at 12:15, Dominic Raferd wrote: > > On Fri, 11 Sep 2020 at 22:49, Julian

Re: SMTP TLS delivery fallback

2020-08-18 Thread Dominic Raferd
On Tue, 18 Aug 2020 at 11:29, Leonardo Rodrigues wrote: > > > Hello Everyone, > > Trying to enable smtp_tls_* on my server for allowing emails > delivery to the world using TLS (not smtpd_tls_*, those are working just > fine for years). > > While i could get it working fine, i'm

Re: non_smtp_milters don't work with spamassassin

2020-08-05 Thread Dominic Raferd
On Wed, 5 Aug 2020 at 08:36, Guido Goluke, MajorLabel wrote: > > I have a setup where I filter smtp mail with: > > smtpd_milters=unix:/spamass/spamass.sock, > unix:/var/run/opendkim/opendkim.sock > > and non-smtp mail with > > non_smtpd_milters=unix:/spamass/spamass.sock, >

Re: Using provider SMTP (Gmail)

2020-07-31 Thread Dominic Raferd
On Thu, 30 Jul 2020 at 16:31, Forums wrote: > > This action modify "From:" and "Reply To:" when you send an email from your > Gmail account. > > I don't want to send email from a different "From:" address when I use my > Gmail account. > > The only thing I wanted is to have the good sender

Re: How To Rewrite "Mail From:"?

2020-07-06 Thread Dominic Raferd
On 06/07/2020 20:53, Viktor Dukhovni wrote: On Mon, Jul 06, 2020 at 07:40:27PM +, Drew Tomlinson wrote: I use postfix for my own domain and have been forwarding my email to outlook.com for years. Recently, email has just been disappearing between my server and my inbox so I set it to

Re: sendmail_fix_line_length enhancement request

2020-06-22 Thread Dominic Raferd
On 18/06/2020 17:17, Dominic Raferd wrote: On Thu, 18 Jun 2020 at 15:03, Wietse Venema wrote: Dominic Raferd: I understand the reason for smtp_line_length_limit and for its default value of 998, which is of course good. It breaks DKIM signatures, it is needed only for mail that is sent via

Re: sendmail_fix_line_length enhancement request

2020-06-18 Thread Dominic Raferd
On Thu, 18 Jun 2020 at 15:03, Wietse Venema wrote: > > Dominic Raferd: > > I understand the reason for smtp_line_length_limit and for its default > > value of 998, which is of course good. > > It breaks DKIM signatures, it is needed only for mail that is sent > via

sendmail_fix_line_length enhancement request

2020-06-18 Thread Dominic Raferd
I understand the reason for smtp_line_length_limit and for its default value of 998, which is of course good. But it is an occasional problem for me that this wrapping action is only applied at smtp stage and not earlier; in particular it is after any (open)dkim milter adds its key, because

Re: Unable to receive emails from btinternet.com

2020-06-18 Thread Dominic Raferd
On Thu, 18 Jun 2020 at 09:46, David Hartley wrote: > > I am running Postfix on a Synology NAS using DSM 6.2 > > In general I can receive emails, however I cannot receive emails > from@ btinternet.com. > > An example of the sender's failure report is: > > Reporting-MTA: dns;

Re: Mail being delivered to incorrect address

2020-06-18 Thread Dominic Raferd
On Thu, 18 Jun 2020 at 08:13, David Hobley wrote: > Sorry, that got sent prior to my completing the email. I'll try again. > > /etc/postfix/main.cf > alias_maps = > append_dot_mydomain = no > compatibility_level = 2 > ... > myorigin = /etc/mailname ... > virtual_alias_domains = >

Re: Postfix restrictions

2020-06-08 Thread Dominic Raferd
On Mon, 8 Jun 2020 at 16:11, PGNet Dev wrote: > On 6/8/20 7:12 AM, Dominic Raferd wrote: > > main.cf <http://main.cf>: > > > > rbl_reply_maps = pcre:/etc/postfix/rbl_reply_maps.pcre > > postscreen_dnsbl_reply_map = > pcre:/etc/postfix/postscreen_dnsbl_re

Re: Postfix restrictions

2020-06-08 Thread Dominic Raferd
On Mon, 8 Jun 2020 at 15:07, PGNet Dev wrote: > > in my logs, i see, e.g. > Jun 8 06:49:08 mx postfix/dnsblog[21103]: addr 151.20.170.84 > listed by domain .zen.dq.spamhaus.net as 127.0.0.10 > > with the "" clearly displayed. > > have you a setting/map in postfix that simply

Re: Alternative SMTP server

2020-06-08 Thread Dominic Raferd
On Mon, 8 Jun 2020 at 09:54, Forums wrote: > Hello all. > > Sorry for my english I'm french. > > I have a private mail server (at home) with my domain name. > > I have about 5% of my emails rejected by some SMTP servers for the > following reasons: > > - rDNS is KO (my french provider don't give

Command line simulation of postfix ip-matching syntax

2020-06-04 Thread Dominic Raferd
Is there a command-line tool that can simulate postfix's ip-matching syntax with semicolons and double dots? # echo "127.0.0.3"|grepcidr "127.0.0.[1;3;5]" grepcidr: Not a valid pattern: 127.0.0.[1;3;5] # echo "127.0.0.3"|grepcidr "127.0.0.[1..5]" grepcidr: Not a valid pattern: 127.0.0.[1..5]

Re: Uninstalling postgrey

2020-05-25 Thread Dominic Raferd
On Mon, 25 May 2020 at 02:06, Ian Evans wrote: > > Based on another thread here, I want to move to using postscreen/postwhite > and ditch postgrey. > > Just want to make sure I don't bungle stopping postgrey. > > So... > > - edit main.cf and remove "check_policy_service inet:127.0.0.1:10023"

Re: dnsblog_query: lookup error for DNS query x.x.x.x.zen.spamhaus.org: Host or domain name not found.

2020-05-08 Thread Dominic Raferd
On Fri, 8 May 2020 at 16:09, Alexander Meinhardt wrote: > for inexplicable reasons i don't get any results from zen.spamhaus.org > anymore: > > Apr 08 16:20:29 [postfix/dnsblog] warning: dnsblog_query: lookup error > for DNS query x.x.x.x.zen.spamhaus.org: Host or domain name not found. > Name

  1   2   3   4   5   >