Re: Postscreen

2013-07-22 Thread Phil Daws
- Original Message - From: Wietse Venema wie...@porcupine.org To: Phil Daws ux...@splatnix.net Cc: Wietse Venema wie...@porcupine.org, postfix-users@postfix.org Sent: Monday, 22 July, 2013 1:19:43 AM Subject: Re: Postscreen Phil Daws: [ Charset UTF-8 unsupported, converting... ] No

Re: Postscreen

2013-07-22 Thread Wietse Venema
Phil Daws: In the end I followed what somebody else had said with: touch /var/lib/postfix/ps_cache postmap btree:/var/lib/postfix/ps_cache chown postfix.postfix /var/lib/postfix/ps_cache service postfix restart For the record, this should not be necessary if redistributors could resist the

Re: Whitelisting from reverse DNS checks

2013-07-22 Thread L.W. van Braam van Vloten
Hello list, Thanks for the info, in a different thread I also saw a reference to http://postfix.1071664.n5.nabble.com/smtpd-recipient-restrictions-Best-Practices-td10171.html and it helped me to modify my config. In addition I upgraded to Postfix 2.9.3 because I want to start using

Re: Whitelisting from reverse DNS checks

2013-07-22 Thread Noel Jones
On 7/22/2013 10:21 AM, L.W. van Braam van Vloten wrote: Hello list, Thanks for the info, in a different thread I also saw a reference to http://postfix.1071664.n5.nabble.com/smtpd-recipient-restrictions-Best-Practices-td10171.html and it helped me to modify my config. In addition I upgraded

Re: postmulti behind NAT

2013-07-22 Thread Jeroen Geilman
On 07/21/2013 12:23 AM, /dev/rob0 wrote: On Sat, Jul 20, 2013 at 05:18:58PM -0400, Wietse Venema wrote: /dev/rob0: The doubt in my mind about this is for mail truly destined to our hosted domains. It resolves to an Internet (not an internal) IP address which is in the MX instance's

Re: postmulti behind NAT

2013-07-22 Thread /dev/rob0
On Mon, Jul 22, 2013 at 08:51:37PM +0200, Jeroen Geilman wrote: Why would you not allow submission to deliver to the hosted domains ? You can simply add the maps to the existing ones you use (if any). The point is that we can never be sure that we actually do host any given domain. Suppose a

allow some senders, but block everyone else

2013-07-22 Thread Florin Andrei
This is a clone of the production site, for QA and testing. This being QA, whenever we run a test of our software, we don't want our test suite to go ahead and blast the Internet with lots of random email messages. OTOH, we need to keep the configuration of the QA site as close to production

Re: Whitelisting from reverse DNS checks

2013-07-22 Thread L.W. van Braam van Vloten
Hi, Thanks for your clear reply, that really helps! One last question: How should I configure local_recipient_maps? Noel said: local_recipient_maps = An empty local_recipient_maps will cause your postfix to accept mail for undeliverable local address, then attempt to bounce

Re: allow some senders, but block everyone else

2013-07-22 Thread Wietse Venema
Florin Andrei: This is a clone of the production site, for QA and testing. This being QA, whenever we run a test of our software, we don't want our test suite to go ahead and blast the Internet with lots of random email messages. OTOH, we need to keep the configuration of the QA site as

Re: Whitelisting from reverse DNS checks

2013-07-22 Thread Noel Jones
On 7/22/2013 4:27 PM, L.W. van Braam van Vloten wrote: Hi, Thanks for your clear reply, that really helps! One last question: How should I configure local_recipient_maps? The default setting of local_recipient_maps = proxy:unix:passwd.byname $alias_maps should be appropriate for the vast

Re: allow some senders, but block everyone else

2013-07-22 Thread Florin Andrei
Okay, let's try this: The goal is to send most emails to local, send most mydomain.com recipients to a relay nearby, and let foobardomain.com senders go out on the Internet freely. In main.cf I have: sender_dependent_default_transport_maps = regexp:/etc/postfix/sender_transport In

Re: allow some senders, but block everyone else

2013-07-22 Thread Wietse Venema
Florin Andrei: Okay, let's try this: The goal is to send most emails to local, send most mydomain.com recipients to a relay nearby, and let foobardomain.com senders go out on the Internet freely. Presumably, if foobardomain.com senders send mail to local or mydomain.com recipients, then

Re: allow some senders, but block everyone else

2013-07-22 Thread Florin Andrei
On 07/22/2013 05:30 PM, Wietse Venema wrote: Florin Andrei: The goal is to send most emails to local, send most mydomain.com recipients to a relay nearby, and let foobardomain.com senders go out on the Internet freely. Presumably, if foobardomain.com senders send mail to local or

Re: allow some senders, but block everyone else

2013-07-22 Thread Wietse Venema
Florin Andrei: On 07/22/2013 05:30 PM, Wietse Venema wrote: Florin Andrei: The goal is to send most emails to local, send most mydomain.com recipients to a relay nearby, and let foobardomain.com senders go out on the Internet freely. Presumably, if foobardomain.com senders send mail

Re: postmulti behind NAT

2013-07-22 Thread Ulrich Zehl
On Sat, Jul 20, 2013 at 03:45:35PM -0500, /dev/rob0 wrote: They don't have hairpin NAT set up, whereby if I try to connect to this NATed IP address it would go to the router and come back to me. I'm fine with that, actually; while that would solve the instant problem, it could be bad in