0

Currently some employees in our organization uses Google calendars, they sign up for google calendar using our own email domain, user1@owndomain.com, and when they create meeting invites, Google's calendar server will send meeting invites using FROM address of user1@ourdomain.com to meeting attendees. I include _spf.google.com in our SPF records, allowing google servers to send emails on behalf of @ourdomain.com.

However, if the attendee has user2@ourdomain.com email address, when google server attempt to deliver a meeting invite from user1@ourdomain.com to user2@ourdomain.com, our email server (postfix) will reject the email since "reject_sender_login_mismatch" has been specified:
smtpd_recipient_restrictions = reject_unauth_pipelining, reject_sender_login_mismatch, reject_unknown_sender_domain, permit_mynetworks, permit_sasl_authenticated

What is the most appropriate solution to allow only the google servers to deliver to @ourdomain.com without logging in and bypassing reject_sender_login_mismatch? And is there a way to specify _spf.google.com as the list of google servers without putting in the exact IP addresses (as the servers may change in the future)?

Improve this question
1
  • Welcome to the site. Please look at the editing help and apply code formatting for example file content and commands/keywords.
    – AdminBee
    Sep 9, 2020 at 7:59

1 Answer 1

Reset to default
0

Having reject_sender_login_mismatch will generally prevent you receiving mail on port 25 from any external servers. You typically should not have this on port 25.

If you truly only want to receive unauthenticated email on port 25 from one particular external server, then you have several options. One is to use a SPF milter, and then use header_checks to REJECT all mail not to/from your domain or which has a failed SPF. This would be resilient to IP changes.

A second approach is to move authenticated email to the submission port (e.g. 587), which is what should be done anyway. Then port 25 can be filtered using iptables or the firewall of your choice. It is fairly simple to resolve _spf.google.com and add these records to the filter rules (and update it via cron).

Improve this answer
2
  • Sorry I should've posted the entire smptd_recipient_restrictions: smtpd_recipient_restrictions = reject_unauth_pipelining, reject_sender_login_mismatch, reject_unknown_sender_domain, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_non_fqdn_recipient, check_sender_access hash:/etc/postfix/sender_access, check_policy_service inet:127.0.0.1:10040, permit currently port 25 accepts email from external servers since the permit at the very end.
    – MistaZ
    Sep 9, 2020 at 13:49
  • So the issue is that currently the server accepts all unauthenticated email, however, does not accept email where the "FROM" address of the email is from our domain and the sender is not logged in / is not allowed to use that FROM address. How do I allow a particular set of servers, that can send unauthenticated email using "FROM" address that is the same as our domain?
    – MistaZ
    Sep 9, 2020 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.