2

Postfix has some nice options to restrict client accesses with respect to DNS/IP address setup and helo names (documentation). For example one can instruct postfix to reject clients if

  • the helo argument is a malformed domain
  • the helo argument is not a fully qualified domain name
  • the IP address has no reverse domain lookup entry
  • the domain from the reverse lookup does not point to the client's IP address
  • the domain has a MX entry

At least in my observation these measures are quite successful against some amount of spam.

What I am missing is a more strict reject option that works like this:

  • reject if the DNS lookup of the helo argument does not match the client's IP address

AFAICS, there is no explicit option to configure this restriction. But perhaps there are other ways to configure that behavior with postfix?

  • I belive you are right – there is no such restriction. The closest would be reject_unknown_hostname. I'm sure you can achieve checking DNS consistency with policy service. – Scyld de Fraud Sep 27 '14 at 15:08
  • @ScylddeFraud, you are referring to postfix.org/SMTPD_POLICY_README.html ? Sounds like the way to go. If you post your comment as answer I'll accept it. – maxschlepzig Sep 27 '14 at 18:04
2

I belive you are right – there is no such restriction. The closest would be reject_unknown_hostname. I'm sure you can achieve checking DNS consistency with policy services → http://www.postfix.org/SMTPD_POLICY_README.html.

1

I searched (the whole :) internet for the same question and ended up in this thread. I was already about to write my own policy server when I noticed that there exists a great one called policyd-weight.

You should take a look at it because it implements even more than HELO-checking. For example DNSBLs with Scoring.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.