Re: reject_unauth_destination

2013-09-01 Thread Noel Jones
like smtpd_sasl_auth_enable = yes in my postconf, so sasl and auth are NOT available on port25, but I still have smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination

reject_unauth_destination

2013-08-31 Thread LuKreme
Is there any downside to using reject_unauth_destination? I had it commented out but I did not have a note on why it was disabled. Reading the description, it seems like it should always be turned on (or at least that it couldn't possibly hurt)? http://www.postfix.org/postconf.5.html

Re: reject_unauth_destination

2013-08-31 Thread James Griffin
!-- On Sat 31.Aug'13 at 8:55:34 BST, LuKreme (krem...@kreme.com), wrote: Is there any downside to using reject_unauth_destination? I had it commented out but I did not have a note on why it was disabled. Reading the description, it seems like it should always be turned on (or at least

Re: reject_unauth_destination

2013-08-31 Thread Noel Jones
On 8/31/2013 2:55 AM, LuKreme wrote: Is there any downside to using reject_unauth_destination? I had it commented out but I did not have a note on why it was disabled. Reading the description, it seems like it should always be turned on (or at least that it couldn't possibly hurt)? http

Re: reject_unauth_destination

2013-08-31 Thread LuKreme
On 31 Aug 2013, at 10:20 , Noel Jones njo...@megan.vbhcs.org wrote: reject_unauth_destination is what keeps you from being an open relay, and is required in either smtpd_recipient_restrictions or (postfix 2.10 and newer) smtpd_relay_restrictions. Hmm. I did run several tests on the are you

Re: permit_dnswl_client vs. reject_unauth_destination

2011-06-26 Thread /dev/rob0
.) Now I understand why this is failing. I guess I'm going to need to do something different with my SMTPD restrictions -- possibly move all my existing client restrictions to be at the end of my list of recipient restrictions (after reject_unauth_destination). Or better yet, just move

Re: permit_dnswl_client vs. reject_unauth_destination

2011-06-25 Thread Noel Jones
reject_unauth_destination). Rich Wales ri...@richw.org It's often recommended to put all restrictions under smtpd_recipient_restrictions to keep life simpler. Basic format... smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination ... whitelists here

permit_dnswl_client vs. reject_unauth_destination

2011-06-24 Thread Rich Wales
in the various restriction lists). In http://www.postfix.org/postconf.5.html#smtpd_client_restrictions, I read that for safety, permit_dnswl_client and permit_rhswl_client are silently ignored when they would override reject_unauth_destination. I understand why this is a good idea when a whitelist

Re: permit_dnswl_client vs. reject_unauth_destination

2011-06-24 Thread Victor Duchovni
On Fri, Jun 24, 2011 at 08:12:28PM -0700, Rich Wales wrote: In http://www.postfix.org/postconf.5.html#smtpd_client_restrictions, I read that for safety, permit_dnswl_client and permit_rhswl_client are silently ignored when they would override reject_unauth_destination. That is ignored

Re: permit_dnswl_client vs. reject_unauth_destination

2011-06-24 Thread Rich Wales
That is ignored in the context of a RCPT TO command (thus in all of the top-level restriction classes when smtpd_delay_reject = yes) for a recipient that would fail reject_unauth_destination. For such a recipient do you really need DNSWL whitelisting? Normally, clients allowed to send

Re: reject_unauth_destination status=2, should be 0

2010-11-22 Thread Ben
Le 20/11/2010 20:55, Victor Duchovni a écrit : On Sat, Nov 20, 2010 at 07:45:41PM +0100, Ben wrote: Thank you for your help ! The recipient domain should be configured as final, but is not. I think that's the problem. I joined the information you asked to avoid line breaking. Turn off

reject_unauth_destination status=2, should be 0

2010-11-20 Thread Ben
Hello, I have a problem of relay access denied with postfix to deliver a mail to one domain (only one, all other domains are ok). I ran smtpd in verbose mode and I can see that it's the reject_unauth_destination generic check that reply with status 2, so postfix reject the mail. So I

Re: reject_unauth_destination status=2, should be 0

2010-11-20 Thread Wietse Venema
Ben: Hello, I have a problem of relay access denied with postfix to deliver a mail to one domain (only one, all other domains are ok). I ran smtpd in Does the domain name match mydestination? If yes, show evidence. Does the domain name match virtual_alias_domains? If yes, show evidence.

Re: reject_unauth_destination status=2, should be 0

2010-11-20 Thread Ben
Le 20/11/2010 18:26, Wietse Venema a écrit : Ben: Hello, I have a problem of relay access denied with postfix to deliver a mail to one domain (only one, all other domains are ok). I ran smtpd in Does the domain name match mydestination? If yes, show evidence. Does the domain name match

Re: reject_unauth_destination status=2, should be 0

2010-11-20 Thread Ben
=reject_unauth_destination Nov 19 17:34:50 kappa postfix/smtpd[23554]: reject_unauth_destination: i...@test-and-test.com Nov 19 17:34:50 kappa postfix/smtpd[23554]: permit_auth_destination: i...@test-and-test.com Nov 19 17:34:50 kappa postfix/smtpd[23554]: ctable_locate: leave existing entry key i

Re: reject_unauth_destination status=2, should be 0

2010-11-20 Thread Victor Duchovni
On Sat, Nov 20, 2010 at 06:49:52PM +0100, Ben wrote: I have a problem of relay access denied with postfix to deliver a mail to one domain (only one, all other domains are ok). I ran smtpd in Does the domain name match mydestination? If yes, show evidence. Does the domain name match

Re: reject_unauth_destination status=2, should be 0

2010-11-20 Thread Victor Duchovni
On Sat, Nov 20, 2010 at 07:45:41PM +0100, Ben wrote: Thank you for your help ! The recipient domain should be configured as final, but is not. I think that's the problem. I joined the information you asked to avoid line breaking. Turn off verbose logging, it is not needed, and obscures the