[SOLVED] Microsoft SNDS Requirements

[zolthar]

I am joinging Microsoft SNDS I am looking into the following for our PMG appliance:
https://postmaster.live.com/pm/policies.aspx

Most is pretty much clear, however my points that I wanted to ask was:

1. After given a numeric SMTP error response code between 500 and 599 (also known as a permanent non-delivery response), the sender must not attempt to retransmit that message to that recipient.
2. After multiple non-delivery responses (see #2), the sender must cease further attempts to send email to that recipient.
3. Sender must not open more than 500 simultaneous connections to Outlook.com inbound email servers without making prior arrangements.
4. Messages must not be transmitted through insecure email relay or proxy servers.

#1 and #2, once a 500 has been received back - by design, PMG does stop sending again. However is this just simply a statement primarily against bulk spammers that simply attempts to flood their system?


#3 I dont think this is an issue, however when I was looking here Configuration > Mail Proxy > Options:


https://splaam.domain.com.au:8006/pmg-docs/pmg-admin-guide.html#_mail_proxy_configuration and http://www.postfix.org/postconf.5.html refers to the incoming connections to the PMG and not the outgoing connections - is there a way to limit outgoing emails per minute and then queue emails if over that limit?

As I know with one of our APPs, when it sends out notifications, it sends out over 1000 emails, and not all will be Microsoft, however it could be given that Outlook.com encompases many of their own plus client domains on Office365.


#4 If TLS and DKIM are setup, all emails appears to be delivered over TLS, would it be safe for me to say that all outgoing emails are encrypted where possible?

 

[Stoiko Ivanov]

is there a way to limit outgoing emails per minute and then queue emails if over that limit?

Never had the necessity to limit outbound mail - so cannot speak from direct experience.
from a quick glance in the postconf manpage - it seems like the following 2 options define the outbound concurrency:
http://www.postfix.org/postconf.5.html#smtp_destination_concurrency_limit
http://www.postfix.org/postconf.5.html#smtp_destination_recipient_limit
Check out the docs for more details and also the tuning readme:
http://www.postfix.org/TUNING_README.html

If you wish to adapt the postfix configuration of your PMG you need to use the templateing system:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_template_engine

#4 If TLS and DKIM are setup, all emails appears to be delivered over TLS, would it be safe for me to say that all outgoing emails are encrypted where possible?

SMTP uses (mostly) opportunistic TLS via STARTTLS meaning if you configured your server to 'use TLS' in the PMG gui it will issue a STARTTLS command if the remote server offers support for it, but will happily send mail without encryption, if the remote system does not offer STARTTLS.

The problem with this is that a MITM might intercept the remote servers response and drop the STARTTLS support, in which case the mail would get send unencrypted, even though it TLS would be possible.

For outbound mail you can set a TLS Destination policy - see:
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#_mail_proxy_configuration (section 4.6.9)

I hope this helps!

 

[zolthar]

Thanks Stoiko for the clarification - still have a headache from the other thread, so will review this next week as this seems "easier", but everything seems easy until I have to actually test implement and nothing works

Cheers mate.