check_sender_mx_access with invalid mx hosts

[Sven 'Darkman' Michels]

Hi there,

i thought its possible to block invalid mx records with the
check_sender_mx_access restriction, but that seems not to be the
case? I want to reject mail from domains with invalid MX records
like "spamgateway.nul" which isn't resolveable. Any recomendations
for that? Postfix will accept such mails which should probably
not happen (mx record isn't resolveable but present, no other
mx records, only an a record), or am i wrong?

Thanks and regards,
Sven

[Jorey Bump]

Post by Sven 'Darkman' Michels
i thought its possible to block invalid mx records with the
check_sender_mx_access restriction, but that seems not to be the
case? I want to reject mail from domains with invalid MX records
like "spamgateway.nul" which isn't resolveable. Any recomendations
for that? Postfix will accept such mails which should probably
not happen (mx record isn't resolveable but present, no other
mx records, only an a record), or am i wrong?

IMHO, if there is a single valid A record or valid MX at any priority,
you shouldn't reject.

[Wietse Venema]

Post by Sven 'Darkman' Michels
Hi there,
i thought its possible to block invalid mx records with the
check_sender_mx_access restriction, but that seems not to be the
case?

check_sender_mx_access restricts access by MX host NAME or ADDRESS.

Post by Sven 'Darkman' Michels
I want to reject mail from domains with invalid MX records
like "spamgateway.nul" which isn't resolveable.

Postfix will restrict access by MX host NAME even when the
name has no address record.

But it cannot restrict access by MX host ADDRESS when that address
does not exist.

Wietse

Post by Sven 'Darkman' Michels
Any recomendations
for that? Postfix will accept such mails which should probably
not happen (mx record isn't resolveable but present, no other
mx records, only an a record), or am i wrong?
Thanks and regards,
Sven

[Sven 'Darkman' Michels]

Post by Wietse Venema
check_sender_mx_access restricts access by MX host NAME or ADDRESS.

Thats what i thought, too.

Post by Wietse Venema

Post by Sven 'Darkman' Michels
I want to reject mail from domains with invalid MX records
like "spamgateway.nul" which isn't resolveable.

Postfix will restrict access by MX host NAME even when the
name has no address record.
But it cannot restrict access by MX host ADDRESS when that address
does not exist.

example: taal.net - i put dev.null as lookup key into my access
table for check_sender_mx_access. When i now try to send a mail
with sender ***@taal.net it will be accepted. So it looks like
NAME isn't considered, at least not when the name doesn't resolve
(i see two errors about resolving problems with the name in the
log)

Laters,
Sven

[Wietse Venema]

Sven 'Darkman' Michels:
[ Charset ISO-8859-1 unsupported, converting... ]

Post by Sven 'Darkman' Michels

Post by Wietse Venema
check_sender_mx_access restricts access by MX host NAME or ADDRESS.

Thats what i thought, too.

Post by Wietse Venema

Post by Sven 'Darkman' Michels
I want to reject mail from domains with invalid MX records
like "spamgateway.nul" which isn't resolveable.

Postfix will restrict access by MX host NAME even when the
name has no address record.
But it cannot restrict access by MX host ADDRESS when that address
does not exist.

example: taal.net - i put dev.null as lookup key into my access
table for check_sender_mx_access. When i now try to send a mail
NAME isn't considered, at least not when the name doesn't resolve
(i see two errors about resolving problems with the name in the
log)

/etc/postfix/main.cf:
smtpd_sender_restrictions =
check_sender_mx_access hash:/etc/postfix/mxaccess ...

/etc/postfix/mxaccess:
dev.null reject bogus XM host

Session:

Connected to spike.porcupine.org.
Escape character is '^]'.
220 spike.porcupine.org ESMTP Postfix (2.3-20051014)
ehlo spike
250-spike.porcupine.org
250-PIPELINING
250-SIZE 20240000
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from:<***@taal.net>
250 2.1.0 Ok
rcpt to:<***@porcupine.org>
554 5.7.1 <***@taal.net>: Sender address rejected: bogus XM host

Yes, I left the typo in place to demonstrate that it really came
from this access rule.

Wietse

[Sven 'Darkman' Michels]

Post by Wietse Venema
Yes, I left the typo in place to demonstrate that it really came
from this access rule.

Ok, but here this doesn't work:
220 rubicon.darkman.de ESMTP Postfix
EHLO bla
250-rubicon.darkman.de
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250 8BITMIME
MAIL FROM:<***@taal.net>
250 Ok
RCPT TO:<***@darkman.de>
250 Ok

now i debug'ed the session:
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: generic_checks:
name=check_helo_access status=0
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: generic_checks:
name=check_sender_mx_access
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: check_server_access: MX
***@taal.net
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: dns_query: taal.net (MX): OK
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: dns_get_answer: type MX for
taal.net
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: warning: Unable to look up
MX host dev.null for Sender address ***@taal.net: Name or service not known
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: generic_checks:
name=check_sender_mx_access status=0
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: generic_checks:
name=check_sender_mx_access
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: check_server_access: MX
***@taal.net
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: dns_query: taal.net (MX): OK
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: dns_get_answer: type MX for
taal.net
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: warning: Unable to look up
MX host dev.null for Sender address ***@taal.net: Name or service not known
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: generic_checks:
name=check_sender_mx_access status=0
Oct 17 19:10:59 rubicon postfix/smtpd[1187]: >>> END Recipient address
RESTRICTIONS <<<

smtpd_recipient_restrictions:
smtpd_recipient_restrictions =
permit_mynetworks,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
reject_authenticated_sender_login_mismatch,
permit_sasl_authenticated,
reject_unauth_destination,
reject_unauth_pipelining,
check_helo_access hash:/etc/postfix/helo_access_maps,
check_sender_mx_access hash:/etc/postfix/mx_access,
check_sender_mx_access cidr:/etc/postfix/mx_access.cidr

content of /etc/postfix/mx_access:
64.94.110.11 reject sender domain matches verisign wild-card
dev.null reject invalid mx record

- -> no go.

mail_version = 2.1.5

Any Idea?

Thanks!
Sven

[Wietse Venema]

Post by Sven 'Darkman' Michels

Post by Wietse Venema
Yes, I left the typo in place to demonstrate that it really came
from this access rule.

...

Post by Sven 'Darkman' Michels
mail_version = 2.1.5
Any Idea?

2.1 is no longer maintained...

Wietse

[Sven 'Darkman' Michels]

Post by Wietse Venema
2.1 is no longer maintained...

yeah, ok, but its a 'bug' in 2.1? i can't simply switch the version
for now, a bugfix would be a good reason ;)

Regards,
Sven

[Wietse Venema]

Sven 'Darkman' Michels:
-- Start of PGP signed section.

Post by Sven 'Darkman' Michels

Post by Wietse Venema
2.1 is no longer maintained...

yeah, ok, but its a 'bug' in 2.1? i can't simply switch the version
for now, a bugfix would be a good reason ;)

In this respect, 2.1.6 is like 2.3: it does access control on the
MX hostname BEFORE it it tries to look up the IP address(es).

Wietse

if (msg_verbose)
msg_info("%s: %s hostname check: %s",
myname, dns_strtype(type), (char *) server->data);
if ((status = check_domain_access(state, table, (char *) server->data,
FULL, &found, reply_name, reply_class,
def_acl)) != 0 || found)
CHECK_SERVER_RETURN(status);
SET_H_ERRNO(0); /* XXX */
if ((hp = gethostbyname((char *) server->data)) == 0) {
msg_warn("Unable to look up %s host %s for %s %s: %s",
dns_strtype(type), (char *) server->data,
reply_class, reply_name, dns_strerror(h_errno));
continue;
}

[Sven 'Darkman' Michels]

Post by Wietse Venema
In this respect, 2.1.6 is like 2.3: it does access control on the
MX hostname BEFORE it it tries to look up the IP address(es).

aww :) Thanks a lot! Will wait for it.

Regards,
Sven

[Wietse Venema]

Sven 'Darkman' Michels:
-- Start of PGP signed section.

Post by Sven 'Darkman' Michels

Post by Wietse Venema
In this respect, 2.1.6 is like 2.3: it does access control on the
MX hostname BEFORE it it tries to look up the IP address(es).

aww :) Thanks a lot! Will wait for it.

No need to wait. 2.1.6 was released in May 2005.

Wietse

[Sven 'Darkman' Michels]

Post by Wietse Venema
No need to wait. 2.1.6 was released in May 2005.

yeah i know, i was not waiting for 2.1.6, i'm waiting for a package
to build which is not my task atm (and i hate it, really.)

Thanks again,
Sven

[Noel Jones]

Post by Sven 'Darkman' Michels
example: taal.net - i put dev.null as lookup key into
my access
table for check_sender_mx_access. When i now try to
send a mail
looks like
NAME isn't considered, at least not when the name
doesn't resolve
(i see two errors about resolving problems with the
name in the
log)

Works for me. I'm using a pcre: map with an entry
something like
/nul+$/ REJECT null MX record

Should work with a hash map also. Some testing
notes... don't test smtpd_*_restrictions with the
sendmail(1) command. Make sure your test isn't
bypassed by permit_mynetworks.
Masquerade as someone else for testing by using
http://www.postfix.org/XCLIENT_README.html
If you think something isn't working, show evidence -
postconf -n, logs, and how you tested.