bokysan/docker-postfix
1
1
Fork 0
mirror of https://github.com/bokysan/docker-postfix.git synced 2024-11-10 17:05:00 +08:00
Code Issues Projects Releases Packages Wiki Activity

Relax SMTPD accept and relay restrictions.

Browse source 
There are some use cases when using `reject_unverified_recipient`
(http://www.postfix.org/postconf.5.html#reject_unverified_recipient)
doesn't seem to be as good idea. This patch fixes this.

While in theory it seems good, in practice (for our use case) it's not:
- the service cannot send out emails as fast, as each "RCPT TO" will
result in a DNS lookup (and connection to the target server), which can
slow things down considerably.
- the target server might just be busy or temporarily offline. This will
prevent the service from sending out the email, which defeats the
purpose of mail bagging.
- we might be behind a firewall and not even be able to connect to the
target server for email validation

Furthermore, this patch include the following line:
`smtpd_relay_restrictions = permit`

This basically opens up relay functionality to any address. Previously
there was an issue if you wanted to send an email to the address which
was listed in the `$ALLOWED_SENDER_DOMAINS`.
This commit is contained in:
Bojan Čekrlić 2018-07-30 08:30:14 +02:00
parent 0638d349bd
commit bd4b3ce754
1 changed files with 13 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
run.sh
View file

@ -59,18 +59,6 @@ else
postconf -# smtp_sasl_security_options
fi
# Set up my networks to list only networks in the local loopback range
#network_table=/etc/postfix/network_table
#touch $network_table
#echo "127.0.0.0/8 any_value" > $network_table
#echo "10.0.0.0/8 any_value" >> $network_table
#echo "172.16.0.0/12 any_value" >> $network_table
#echo "192.168.0.0/16 any_value" >> $network_table
## Ignore IPv6 for now
##echo "fd00::/8" >> $network_table
#postmap $network_table
#postconf -e mynetworks=hash:$network_table
if [ ! -z "$MYNETWORKS" ]; then
postconf -e mynetworks=$MYNETWORKS
else
@ -92,12 +80,22 @@ if [ ! -z "$ALLOWED_SENDER_DOMAINS" ]; then
postconf -e "smtpd_restriction_classes=allowed_domains_only"
postconf -e "allowed_domains_only=permit_mynetworks, reject_non_fqdn_sender reject"
postconf -e "smtpd_recipient_restrictions=reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unverified_recipient, check_sender_access hash:$allowed_senders, reject"
# Update: loosen up on RCPT checks. This will mean we might get some emails which are not valid, but the service connecting
# will be able to send out emails much faster, as there will be no lookup and lockup if the target server is not responing or availalb.e
# postconf -e "smtpd_recipient_restrictions=reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unverified_recipient, check_sender_access hash:$allowed_senders, reject"
postconf -e "smtpd_recipient_restrictions=reject_non_fqdn_recipient, reject_unknown_recipient_domain, check_sender_access hash:$allowed_senders, reject"
else
postconf -# "smtpd_restriction_classes"
postconf -e "smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,reject_unverified_recipient"
# Update: loosen up on RCPT checks. This will mean we might get some emails which are not valid, but the service connecting
# will be able to send out emails much faster, as there will be no lookup and lockup if the target server is not responing or availalb.e
# postconf -e "smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,reject_unverified_recipient"
postconf -e "smtpd_recipient_restrictions=reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit"
fi
# Since we are behind closed doors, let's just permit all relays.
postconf -e "smtpd_relay_restrictions=permit"
# Use 587 (submission)
sed -i -r -e 's/^#submission/submission/' /etc/postfix/master.cf
@ -113,3 +111,4 @@ fi
echo "- Staring rsyslog and postfix"
exec supervisord -c /etc/supervisord.conf