Re: reject_sender_login_mismatch doesnt work

2 msg	2 postfix server on the same domain in differen...
3 msg	mailer-deamon sends error messages to: question
3 msg	Procmail
15 msg	MAIL FROM timeout with ciphers=high
2 msg	milter, broken pipe
17 msg	How to listen on 587 as well as 25?

reject_sender_login_mismatch doesnt work
\ Patrick T. Tsang (30 Nov 2007)
. \ Sahil Tandon (30 Nov 2007)
. \ Patrick T. Tsang (30 Nov 2007)
. . \ MacShane, Tracy (30 Nov 2007)
. . \ mouss (30 Nov 2007)
. \ Patrick T. Tsang (30 Nov 2007)

2 msg	smtp auth
4 msg	Postfix with MYSQL compile error
8 msg	mynetworks=<empty> vs mynetworks=<defa...
3 msg	message_size_limit with ldap search parameter
2 msg	Pipe debugging
12 msg	destination_concurrency_limit not respected ?
13 msg	Virtual spam forwarding issues
2 msg	cleaning up deferred queue
2 msg	static nexthop per domain
2 msg	Simple postmap question
9 msg	Issues with Recipient_Canonical mapping
3 msg	Mail server reboot after got flood
3 msg	can't create a virtual domain

Subject:	Re: reject_sender_login_mismatch doesnt work
Group:	Postfix-users
From:	mouss
Date:	30 Nov 2007

Patrick T. Tsang wrote:
> Hello,
>

Please do not top post: put your replies after the text you reply to.

There are two types of addresses:

- envelope addresses used for routing email. These are the ones that
smtpd restrictions check.

- header addresses used for "information" only. This is what mailers
(thunderbird, outlook, ...) show. These include: From:, Reply-To:, To:
and Cc:.

smtpd restrictions do not check header addresses. header addresses are
found in the mail data, and are thus received after the DATA command
(which comes after the last RCPT TO command).

header_checks may help if the need is simple. but header_checks act on a
header at a time, and there is no way to use "other" information
(whether user was authenticated, ... etc).

> Typical case is that some spammers send mails using our offical user
> emails as the reply addresses.
> Our staffs receive these bounced messages from our mail server for
> undeliverable mails.
>

if these are bounces of forged mail sent from remote sites, then it is
backscatter. whatever you do on your server won't help (the forged mail
was received by an other server).

if the bounces are sent by your own server, then you have something
broken in your configuration. do not accept mail to invalid recipients.

> The reject_unauthenticated_sender_login_mismatch simply cannot solve.
>

reject_*_login_mismatch operate on the envelope sender based on infos
found in smtpd_sender_login_maps.

If you want more help, please show a real example (the headers of a
message. feel free to obfuscate private infos, but do that coherently
and without destroying evidence).