Blocking emails that claim to come from our

[Glenn Steen]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On 07/12/05, Jon Leeman <technician at cenpac.net.nr> wrote:
> Drew Marshall wrote:
> > On Wed, December 7, 2005 16:59, Jon Leeman wrote:
> >
> >>I just tried,
> >>
> >>smtpd_client_restrictions = permit_mynetworks, check_client_access
> >>hash:/etc/postfix/mydomain_rules
> >>smtpd_helo_restrictions = permit_mynetworks,  check_helo_access
> >>hash:/etc/postfix/mydomain_rules
> >>
> >>(without the warn_if_reject)
> >>
> >>and received this from the MX from outside the network,
> >>
> >>220 nract1.cenpac.net.nr GATEWAY MX  - We don't authorise this
> >>mailserver for the transport of unsolicited and/or bulk email.
> >>helo jon.cenpac.net.nr
> >>250 nract1.cenpac.net.nr
> >>mail from:postmaster at cenpac.net.nr
> >>250 Ok
> >>rcpt to:jleeman at cenpac.net.nr
> >>554 <jon.cenpac.net.nr>: Helo command rejected: Rejected. You are not me
> >>
> >>>my mydomain_rules:
> >>>flyairpanama.com REJECT Rejected. You are not me.
> >
> >
> > Could you post the logs from this.
>
>  From /var/mail/info [Mandrake 10.0]
>
> Dec  8 05:12:09 nract1 postfix/smtpd[6820]: NOQUEUE: reject: RCPT from
> unknown[203.98.227.11]: 554 <jon.cenpac.net.nr>: Helo command rejected:
> Rejected.  You are not me.; from=<postmaster at cenpac.net.nr>
> to=<jleeman at cenpac.net.nr> proto=SMTP helo=<jon.cenpac.net.nr>
>
> Regards,
>
> Jon
>
Excellent, this nicely demonstrates that your postfix (like most, I'd
imagine) is setup to delay any rejections happening at HELO, MAIL
FROM:.... and RCPT TO: to after the first RCPT TO:, since there are
MTAs out there that will not honour a reject code prior to that.
Perfect. Thanks.

--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!