Re: Can't figure out if this rejection is coming from SPF checking or another reject_unknown_sender

4 msg	Forwards vs aliases ?
4 msg	no content-filter for authed users
2 msg	postfix does not flush queued mails
1 msg	Re: [dkim-milter-beta] mlfi_negotiate() problem
2 msg	newby Q
14 msg	PAM 'smtp' file question
5 msg	Cyrus SASL2 + Postfix + PAM - part 3
9 msg	transport error?

Can't figure out if this rejection is coming fr...
\ GT4NE1 (14 Nov 2007)
. \ Noel Jones (15 Nov 2007)
. \ Noel Jones (15 Nov 2007)

8 msg	Alias with check_recipient_access: /etc/ppostfi...
2 msg	NDR reports
7 msg	Sender-ID and the Hotmail devil...
2 msg	Postifx with IMAP
2 msg	Postfix and procmail
4 msg	destination limits - what is 'destination'
1 msg	Redirect message based on Conditions
1 msg	Cyrus SASL2 + Postfix + PAM - part 2
6 msg	Cyrus SASL2 + Postfix + PAM
5 msg	header_checks and content_filter documentation ...
2 msg	Some problem configuring postfix/procmail with ...

Subject:	Re: Can't figure out if this rejection is coming from SPF checking or another reject_unknown_sender
Group:	Postfix-users
From:	Noel Jones
Date:	15 Nov 2007

On Wed, Nov 14, 2007 at 03:31:49PM -0800, GT4NE1 wrote:
> check_policy_service unix:private/policy,
> reject_rbl_client zen.spamhaus.org,
> reject_rbl_client cbl.abuseat.org,

Note that cbl is included in zen.spamhaus.org, so
this lookup isn't necessary.

> show_user_unknown_table_name = no

OK, but this makes diagnosing problems harder.
(unless you have a simple config where all the
users are in just one table).

> 1. It's my understanding that because I have
> reject_unknown_sender_domain in the smtpd_recipient_restrictions and
> not smtpd_helo_restrictions, it shouldn't reject email from a HELO
> hostname that doesn't have a DNS record, correct? For that I would
> use reject_unknown_hostname in the smtpd_helo_restrictions list.

Mostly correct. Except behavior doesn't change based on where you
place those rules..
ie. reject_unknown_sender_domain always/only acts on the sender domain.

> 2. I know this isn't the OpenSPF list, but I guess OpenSPF checks for
> a published record for the HELO hostname then? And if it doesn't find
> one or can't resolve the hostname at all, it rejects it?

Apparently. You'll need to check with them about the specifics.
There may be some control to change the behavior.

--
Noel Jones