Reject unknown clients and senders

[Hugo Almeida]

Good Morning,

Do you want to clarify a doubt, there are two options of features in Proxmox Mail Gateway, in Options within Mail Proxy, which says - Reject unknown clients and another Reject unknown senders. If you enable these features or what you need exactly, do you need to work with the rules ??

Thanks in advance for your attention.

Sincerely,

Hugo Almeida

 

[hata_ph]

Just enable the postfix option...no extra step

http://www.postfix.org/postconf.5.html#reject_unknown_client_hostname
http://www.postfix.org/postconf.5.html#reject_unknown_sender_domain

 

[Hugo Almeida]

This is not the answer I expected, but I thank you for your attention.
My question is what do these two features of PROXMOX MAIL GATEWAY do ???

- Reject Unknown Customers

- Reject Unknown Senders

If I enable these two features, what will it do ???

Thanks in advance.

 

[Stoiko Ivanov]

As @hata_ph said - the 2 checkboxes simply enable the 2 options in Postfix's main.cf (postfix is the MTA PMG uses) for the smtpd_sender_restrictions (http://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions and http://www.postfix.org/SMTPD_ACCESS_README.html)

the documentation linked explains the effect of the 2 options quite well.

I hope this helps!

 

[Hugo Almeida]

It's ok. Thank you very much for the answer.

 

[eugenevdm]

After battling to understand these settings myself, and then carefully reading the Postfix documentation over and over again, I conclude these are both very good settings to enable by default.

1. The first setting, "Reject Unknown Clients", does a more intense PTR check and if there are inconsistencies it will reject emails.

In my opinion, if there are any false positives here, it will be manageable because reputable email administrators always make perfect PTRs, forward and reverse. Problems here will be quickly escalated by your end-users.

2. The setting "Reject Unknown Senders" scrutinizes validity of the MX record, as per the Postfix docs "...the MAIL FROM domain has 1) no DNS MX and no DNS A record".

In my opinion, this also sounds like a good idea because the domain part (e.g. example.com) must exist and an A record should also be present.

My guess is the Proxmox experts haven't enable these settings by default because there is an odd chance of false positives. Or perhaps it's Postfix that takes the side of caution. Anyway, it's on my system now and I'll report back if I have troubles.