Use smtpd_helo_restrictions?

[myfirstnameispaul]

I was just reading through the Postfix documentation and discovered smtpd_helo_restrictions has some useful configurations.

I found reject_unknown_helo_hostname interesting as a fair number of the messages that, granted, only make it into the spam folder, but don't have a valid hostname A or MX record (one clever bastard was using the PTR for a business ISP IP address as the EHLO).

reject_unknown_helo_hostname
Reject the request when the HELO or EHLO hostname has no DNS A or MX record.

I'm not sure where this might cause problems for other boxes, but so far I haven't found any issues on mine.

[myfirstnameispaul]

Oh, here is what I've added to main.cf:

smtpd_helo_restrictions=permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination,reject_unknown_helo_hostname

[kiekerjan]

I recently found http://unixwiz.net/techtips/postfix-HELO.html which talks about a limited set of help checks.
I'd say that if there is a change you're blocking legitimatie mail, you should not add it to the configuration.

[myfirstnameispaul]

Thanks, I hadn't found that article, but it is a faster way to find all that stuff than attempting to parse through the Postfix spaghetti documentation format.

I had already set myself a cron job to grep "command rejected" /var/log/mail.log and so far the only one failing that isn't spam also fails on so many other things it doesn't matter.

Note that smtpd_delay_reject = yes is default that you can see by running postconf | grep "delay_reject".

I didn't configure smtpd_helo_required = yes because I first want to see if reject_unknown_helo_hostname breaks anything before experimenting further.

A separate topic, but I'm making use of several access(5) database rules that I wish I didn't have to add back to main.cf after every update to the point that I wonder what the harm would be if MiaB included configured tables in main.cf but empty files.