Postfix Configuration - UCE Controls
Postfix Configuration - UCE ControlsBy default, the Postfix SMTP server will accept mail only from or to the local network or domain, or to domains that are hosted by Postfix, so that your system can't be used as a mail relay to forward bulk mail from random strangers.
The text in this document describes how you can set up more detailed anti-UCE policies that prevent delivery of unwanted email altogether, for example with sendmail-style access lists or with RBL (real-time blackhole list) name servers.
Unless indicated otherwise, all parameters described here are in the main.cf file. If you change parameters of a running Postfix system, don't forget to issue a postfix reload command.
At present, specifying a header pattern with OK serves no useful purpose. A rule ending in OK affects only the header being matched. The next header may still result in a REJECT match, causing the mail still to be rejected.
By default, this restriction is applied when the client sends the
RCPT TO command. In order to have the restriction take effect
as soon as possible, specify smtpd_delay_reject = no in
the Postfix main.cf configuration file. Doing so may cause
unexpected results with poorly implemented client software.
By default, this restriction is applied when the client sends the
RCPT TO command. In order to have the restriction take effect
as soon as possible, specify smtpd_delay_reject = yes in
the Postfix main.cf configuration file. Doing so may cause
unexpected results with poorly implemented client software.
In addition to restrictions that are specific to HELO (EHLO)
command parameters, you can also specify restrictions based
on the client hostname or network address.
By default, this restriction is applied when the client sends the
RCPT TO command. In order to have the restriction take effect
as soon as possible, specify smtpd_delay_reject = yes in
the Postfix main.cf configuration file. Doing so may cause
unexpected results with poorly implemented client software.
In addition to restrictions that are specific to sender mail
addresses, you can also specify restrictions based on the information
passed with the HELO/EHLO command, and on the client hostname or
network address.
In addition to the above, the Postfix SMTP
server by default accepts mail for which Postfix is the final
destination:
In addition to restrictions that are specific to recipient mail
addresses, you can also specify restrictions based on the sender mail
address, on the information passed with the HELO/EHLO command, and
on the client hostname or network address.
Use the optional
permit_mx_backup_networks parameter to also require that the
primary MX hosts match a list of network blocks.
Relevant configuration parameters: permit_mx_backup_networks,
$mydestination, $inet_interfaces.
In addition to restrictions that are specific to ETRN domain names,
you can also specify restrictions based on the information passed
with the HELO/EHLO command, and on the client hostname or network
address.
That is, all networks are authorized by default.
You can also specify the absolute pathname of a pattern file instead
of listing the patterns in the main.cf file.
Note: RBL lookups are disabled by default.
A host or destination address matches $relay_domains when
its name or parent domain matches any of the names, files or lookup
tables listed in $relay_domains.
Each map entry specifies a sender address and the login name that
owns the address. The search order is:
Client hostname/address restrictions
The smtpd_client_restrictions parameter restricts what
clients this system accepts SMTP connections from.
Require HELO (EHLO) command
The smtpd_helo_required parameter determines if clients must
send a HELO (or EHLO) command at the beginning of an
SMTP session. Requiring this will stop some UCE software.
HELO (EHLO) hostname restrictions
The smtpd_helo_restrictions parameter restricts what hostnames
clients may send with the HELO (EHLO) command. Some
UCE software can be stopped by being strict here.
Require strict RFC 821-style envelope addresses
The strict_rfc821_envelopes parameter controls how tolerant
Postfix is with respect to addresses given in MAIL FROM or RCPT TO
commands. Unfortunately, the widely-used Sendmail program tolerates
lots of non-standard behavior, so a lot of software expects to get
away with it. Being strict to the RFC not only stops unwanted
mail, it also blocks legitimate mail from poorly-written mail
applications.
Sender address restrictions
The smtpd_sender_restrictions parameter restricts what sender
addresses this system accepts in MAIL FROM commands.
Recipient address restrictions
The smtpd_recipient_restrictions parameter restricts what
recipient addresses this system accepts in RCPT TO commands.
Otherwise reject the request. The relay_domains_reject_code
parameter specifies the response code for rejected requests (default:
554).
Otherwise proceed with the next restriction.
The relay_domains_reject_code parameter specifies the response
code for rejected requests (default: 554).
ETRN command restrictions
Not really an UCE restriction, the smtpd_etrn_restrictions
parameter restricts what domains can be specified in ETRN commands,
and what clients can issue ETRN commands.
Generic restrictions
The following restrictions can use used for client hostnames or
addresses, for HELO (EHLO) hostnames, for sender mail addresses
and for recipient mail addresses.
Restrictions:
Additional UCE control parameters
Up one level | Basic
Configuration | UCE Controls | Rate
Controls | Resource Controls | Address Manipulation