>>> # >>> # Initialize. >>> # >>> #! ../bin/postmap smtpd_check_access >>> #msg_verbose 1 >>> smtpd_delay_reject 0 OK >>> mynetworks 127.0.0.0/8,168.100.189.0/28 OK >>> relay_domains porcupine.org OK >>> maps_rbl_domains dnsbltest.porcupine.org OK >>> # >>> # Test the client restrictions. >>> # >>> client_restrictions permit_mynetworks,reject_unknown_client,hash:./smtpd_check_access OK >>> client unknown 131.155.210.17 ./smtpd_check: : reject: CONNECT from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; proto=SMTP 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] >>> client unknown 168.100.189.13 OK >>> client random.bad.domain 123.123.123.123 ./smtpd_check: : reject: CONNECT from random.bad.domain[123.123.123.123]: 554 5.7.1 : Client host rejected: match bad.domain; proto=SMTP 554 5.7.1 : Client host rejected: match bad.domain >>> client friend.bad.domain 123.123.123.123 OK >>> client bad.domain 123.123.123.123 ./smtpd_check: : reject: CONNECT from bad.domain[123.123.123.123]: 554 5.7.1 : Client host rejected: match bad.domain; proto=SMTP 554 5.7.1 : Client host rejected: match bad.domain >>> client wzv.win.tue.nl 131.155.210.17 OK >>> client aa.win.tue.nl 131.155.210.18 ./smtpd_check: : reject: CONNECT from aa.win.tue.nl[131.155.210.18]: 554 5.7.1 : Client host rejected: match 131.155.210; proto=SMTP 554 5.7.1 : Client host rejected: match 131.155.210 >>> client_restrictions permit_mynetworks OK >>> # >>> # Test the helo restrictions >>> # >>> helo_restrictions permit_mynetworks,reject_unknown_client,reject_invalid_hostname,reject_unknown_hostname,hash:./smtpd_check_access OK >>> client unknown 131.155.210.17 OK >>> helo foo. ./smtpd_check: : reject: HELO from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; proto=SMTP helo= 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] >>> client foo 123.123.123.123 OK >>> helo foo. ./smtpd_check: : reject: HELO from foo[123.123.123.123]: 450 4.7.1 : Helo command rejected: Host not found; proto=SMTP helo= 450 4.7.1 : Helo command rejected: Host not found >>> helo foo ./smtpd_check: : reject: HELO from foo[123.123.123.123]: 450 4.7.1 : Helo command rejected: Host not found; proto=SMTP helo= 450 4.7.1 : Helo command rejected: Host not found >>> helo spike.porcupine.org ./smtpd_check: : reject: HELO from foo[123.123.123.123]: 554 5.7.1 : Helo command rejected: name server spike.porcupine.org; proto=SMTP helo= 554 5.7.1 : Helo command rejected: name server spike.porcupine.org >>> helo_restrictions permit_mynetworks,reject_unknown_client,reject_invalid_hostname,hash:./smtpd_check_access OK >>> helo random.bad.domain ./smtpd_check: : reject: HELO from foo[123.123.123.123]: 554 5.7.1 : Helo command rejected: match bad.domain; proto=SMTP helo= 554 5.7.1 : Helo command rejected: match bad.domain >>> helo friend.bad.domain OK >>> helo_restrictions reject_invalid_hostname,reject_unknown_hostname OK >>> helo 123.123.123.123 ./smtpd_check: : reject: HELO from foo[123.123.123.123]: 450 4.7.1 <123.123.123.123>: Helo command rejected: Host not found; proto=SMTP helo=<123.123.123.123> 450 4.7.1 <123.123.123.123>: Helo command rejected: Host not found >>> helo [123.123.123.123] OK >>> helo [::] ./smtpd_check: : reject: HELO from foo[123.123.123.123]: 501 5.5.2 <[::]>: Helo command rejected: invalid ip address; proto=SMTP helo=<[::]> 501 5.5.2 <[::]>: Helo command rejected: invalid ip address >>> helo [ipv6:::] OK >>> helo [ipv6::::] ./smtpd_check: : reject: HELO from foo[123.123.123.123]: 501 5.5.2 <[ipv6::::]>: Helo command rejected: invalid ip address; proto=SMTP helo=<[ipv6::::]> 501 5.5.2 <[ipv6::::]>: Helo command rejected: invalid ip address >>> helo_restrictions permit_naked_ip_address,reject_invalid_hostname,reject_unknown_hostname OK >>> helo 123.123.123.123 ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead OK >>> # >>> # Test the sender restrictions >>> # >>> sender_restrictions permit_mynetworks,reject_unknown_client OK >>> client unknown 131.155.210.17 OK >>> mail foo@watson.ibm.com ./smtpd_check: : reject: MAIL from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; from= proto=SMTP helo=<123.123.123.123> 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] >>> client unknown 168.100.189.13 OK >>> mail foo@watson.ibm.com OK >>> client foo 123.123.123.123 OK >>> mail foo@watson.ibm.com OK >>> sender_restrictions reject_unknown_address OK >>> mail foo@watson.ibm.com OK >>> mail foo@bad.domain ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 450 4.1.8 : Sender address rejected: Domain not found; from= proto=SMTP helo=<123.123.123.123> 450 4.1.8 : Sender address rejected: Domain not found >>> sender_restrictions hash:./smtpd_check_access OK >>> mail bad-sender@any.domain ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match bad-sender@; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match bad-sender@ >>> mail bad-sender@good.domain OK >>> mail reject@this.address ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match reject@this.address; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match reject@this.address >>> mail Reject@this.address ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match reject@this.address; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match reject@this.address >>> mail foo@bad.domain ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match bad.domain; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match bad.domain >>> mail foo@Bad.domain ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match bad.domain; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match bad.domain >>> mail foo@random.bad.domain ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match bad.domain; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match bad.domain >>> mail foo@friend.bad.domain OK >>> # >>> # Test the recipient restrictions >>> # >>> recipient_restrictions permit_mynetworks,reject_unknown_client,check_relay_domains OK >>> client unknown 131.155.210.17 OK >>> rcpt foo@watson.ibm.com ./smtpd_check: : reject: RCPT from unknown[131.155.210.17]: 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17]; from= to= proto=SMTP helo=<123.123.123.123> 450 4.7.1 Client host rejected: cannot find your hostname, [131.155.210.17] >>> client unknown 168.100.189.13 OK >>> rcpt foo@watson.ibm.com OK >>> client foo 123.123.123.123 OK >>> rcpt foo@watson.ibm.com ./smtpd_check: warning: support for restriction "check_relay_domains" will be removed from Postfix; use "reject_unauth_destination" instead ./smtpd_check: : reject: RCPT from foo[123.123.123.123]: 554 5.7.1 : Recipient address rejected: Relay access denied; from= to= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Recipient address rejected: Relay access denied >>> rcpt foo@porcupine.org OK >>> recipient_restrictions check_relay_domains OK >>> client foo.porcupine.org 168.100.189.13 OK >>> rcpt foo@watson.ibm.com OK >>> rcpt foo@porcupine.org OK >>> client foo 123.123.123.123 OK >>> rcpt foo@watson.ibm.com ./smtpd_check: : reject: RCPT from foo[123.123.123.123]: 554 5.7.1 : Recipient address rejected: Relay access denied; from= to= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Recipient address rejected: Relay access denied >>> rcpt foo@porcupine.org OK >>> recipient_restrictions hash:./smtpd_check_access OK >>> mail bad-sender@any.domain ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match bad-sender@; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match bad-sender@ >>> mail bad-sender@good.domain OK >>> mail reject@this.address ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match reject@this.address; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match reject@this.address >>> mail foo@bad.domain ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match bad.domain; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match bad.domain >>> mail foo@random.bad.domain ./smtpd_check: : reject: MAIL from foo[123.123.123.123]: 554 5.7.1 : Sender address rejected: match bad.domain; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Sender address rejected: match bad.domain >>> mail foo@friend.bad.domain OK >>> # >>> # RBL >>> # >>> client_restrictions reject_maps_rbl OK >>> client spike.porcupine.org 168.100.189.2 ./smtpd_check: warning: support for restriction "reject_maps_rbl" will be removed from Postfix; use "reject_rbl_client domain-name" instead OK >>> client foo 127.0.0.2 ./smtpd_check: : reject: CONNECT from foo[127.0.0.2]: 554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org; from= proto=SMTP helo=<123.123.123.123> 554 5.7.1 Service unavailable; Client host [127.0.0.2] blocked using dnsbltest.porcupine.org >>> # >>> # Hybrids >>> # >>> recipient_restrictions check_relay_domains OK >>> client foo 131.155.210.17 OK >>> rcpt foo@watson.ibm.com ./smtpd_check: : reject: RCPT from foo[131.155.210.17]: 554 5.7.1 : Recipient address rejected: Relay access denied; from= to= proto=SMTP helo=<123.123.123.123> 554 5.7.1 : Recipient address rejected: Relay access denied >>> recipient_restrictions check_client_access,hash:./smtpd_check_access,check_relay_domains OK >>> client foo 131.155.210.17 OK >>> rcpt foo@porcupine.org OK >>> helo_restrictions permit_mynetworks,reject_unknown_client,reject_invalid_hostname,hash:./smtpd_check_access OK >>> recipient_restrictions check_helo_access,hash:./smtpd_check_access,check_relay_domains OK >>> helo bad.domain ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 554 5.7.1 : Helo command rejected: match bad.domain; from= proto=SMTP helo= 554 5.7.1 : Helo command rejected: match bad.domain >>> rcpt foo@porcupine.org ./smtpd_check: : reject: RCPT from foo[131.155.210.17]: 554 5.7.1 : Helo command rejected: match bad.domain; from= to= proto=SMTP helo= 554 5.7.1 : Helo command rejected: match bad.domain >>> helo 131.155.210.17 OK >>> rcpt foo@porcupine.org OK >>> recipient_restrictions check_sender_access,hash:./smtpd_check_access,check_relay_domains OK >>> mail foo@bad.domain ./smtpd_check: : reject: MAIL from foo[131.155.210.17]: 554 5.7.1 : Sender address rejected: match bad.domain; from= proto=SMTP helo=<131.155.210.17> 554 5.7.1 : Sender address rejected: match bad.domain >>> rcpt foo@porcupine.org ./smtpd_check: : reject: RCPT from foo[131.155.210.17]: 554 5.7.1 : Sender address rejected: match bad.domain; from= to= proto=SMTP helo=<131.155.210.17> 554 5.7.1 : Sender address rejected: match bad.domain >>> mail foo@friend.bad.domain OK >>> rcpt foo@porcupine.org OK >>> # >>> # MX backup >>> # >>> #mydestination spike.porcupine.org,localhost.porcupine.org >>> #inet_interfaces 168.100.189.2,127.0.0.1 >>> #recipient_restrictions permit_mx_backup,reject >>> #rcpt wietse@wzv.win.tue.nl >>> #rcpt wietse@trouble.org >>> #rcpt wietse@porcupine.org >>> # >>> # Deferred restrictions >>> # >>> client_restrictions permit OK >>> helo_restrictions permit OK >>> sender_restrictions permit OK >>> recipient_restrictions check_helo_access,hash:./smtpd_check_access,check_sender_access,hash:./smtpd_check_access OK >>> helo bad.domain OK >>> mail foo@good.domain OK >>> rcpt foo@porcupine.org ./smtpd_check: : reject: RCPT from foo[131.155.210.17]: 554 5.7.1 : Helo command rejected: match bad.domain; from= to= proto=SMTP helo= 554 5.7.1 : Helo command rejected: match bad.domain >>> helo good.domain OK >>> mail foo@bad.domain OK >>> rcpt foo@porcupine.org ./smtpd_check: : reject: RCPT from foo[131.155.210.17]: 554 5.7.1 : Sender address rejected: match bad.domain; from= to= proto=SMTP helo= 554 5.7.1 : Sender address rejected: match bad.domain >>> # >>> # FQDN restrictions >>> # >>> helo_restrictions reject_non_fqdn_hostname OK >>> sender_restrictions reject_non_fqdn_sender OK >>> recipient_restrictions reject_non_fqdn_recipient OK >>> helo foo.bar. OK >>> helo foo.bar OK >>> helo foo ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; from= proto=SMTP helo= 504 5.5.2 : Helo command rejected: need fully-qualified hostname >>> mail foo@foo.bar. OK >>> mail foo@foo.bar OK >>> mail foo@foo ./smtpd_check: : reject: MAIL from foo[131.155.210.17]: 504 5.5.2 : Sender address rejected: need fully-qualified address; from= proto=SMTP helo= 504 5.5.2 : Sender address rejected: need fully-qualified address >>> mail foo ./smtpd_check: : reject: MAIL from foo[131.155.210.17]: 504 5.5.2 : Sender address rejected: need fully-qualified address; from= proto=SMTP helo= 504 5.5.2 : Sender address rejected: need fully-qualified address >>> rcpt foo@foo.bar. OK >>> rcpt foo@foo.bar OK >>> rcpt foo@foo ./smtpd_check: : reject: RCPT from foo[131.155.210.17]: 504 5.5.2 : Recipient address rejected: need fully-qualified address; from= to= proto=SMTP helo= 504 5.5.2 : Recipient address rejected: need fully-qualified address >>> rcpt foo ./smtpd_check: : reject: RCPT from foo[131.155.210.17]: 504 5.5.2 : Recipient address rejected: need fully-qualified address; from= to= proto=SMTP helo= 504 5.5.2 : Recipient address rejected: need fully-qualified address >>> # >>> # Numerical HELO checks >>> # >>> helo_restrictions permit_naked_ip_address,reject_non_fqdn_hostname OK >>> helo [1.2.3.4] ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead OK >>> helo [321.255.255.255] ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[321.255.255.255]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[321.255.255.255]> 501 5.5.2 <[321.255.255.255]>: Helo command rejected: invalid ip address >>> helo [0.255.255.255] ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[0.255.255.255]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[0.255.255.255]> 501 5.5.2 <[0.255.255.255]>: Helo command rejected: invalid ip address >>> helo [1.2.3.321] ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1.2.3.321]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1.2.3.321]> 501 5.5.2 <[1.2.3.321]>: Helo command rejected: invalid ip address >>> helo [1.2.3] ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1.2.3]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1.2.3]> 501 5.5.2 <[1.2.3]>: Helo command rejected: invalid ip address >>> helo [1.2.3.4.5] ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1.2.3.4.5]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1.2.3.4.5]> 501 5.5.2 <[1.2.3.4.5]>: Helo command rejected: invalid ip address >>> helo [1..2.3.4] ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1..2.3.4]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1..2.3.4]> 501 5.5.2 <[1..2.3.4]>: Helo command rejected: invalid ip address >>> helo [.1.2.3.4] ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[.1.2.3.4]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[.1.2.3.4]> 501 5.5.2 <[.1.2.3.4]>: Helo command rejected: invalid ip address >>> helo [1.2.3.4.5.] ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <[1.2.3.4.5.]>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<[1.2.3.4.5.]> 501 5.5.2 <[1.2.3.4.5.]>: Helo command rejected: invalid ip address >>> helo 1.2.3.4 ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead OK >>> helo 321.255.255.255 ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <321.255.255.255>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<321.255.255.255> 501 5.5.2 <321.255.255.255>: Helo command rejected: invalid ip address >>> helo 0.255.255.255 ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <0.255.255.255>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<0.255.255.255> 501 5.5.2 <0.255.255.255>: Helo command rejected: invalid ip address >>> helo 1.2.3.321 ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1.2.3.321>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1.2.3.321> 501 5.5.2 <1.2.3.321>: Helo command rejected: invalid ip address >>> helo 1.2.3 ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1.2.3>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1.2.3> 501 5.5.2 <1.2.3>: Helo command rejected: invalid ip address >>> helo 1.2.3.4.5 ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1.2.3.4.5>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1.2.3.4.5> 501 5.5.2 <1.2.3.4.5>: Helo command rejected: invalid ip address >>> helo 1..2.3.4 ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1..2.3.4>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1..2.3.4> 501 5.5.2 <1..2.3.4>: Helo command rejected: invalid ip address >>> helo .1.2.3.4 ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <.1.2.3.4>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<.1.2.3.4> 501 5.5.2 <.1.2.3.4>: Helo command rejected: invalid ip address >>> helo 1.2.3.4.5. ./smtpd_check: warning: restriction permit_naked_ip_address is deprecated. Use permit_mynetworks or permit_sasl_authenticated instead ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 501 5.5.2 <1.2.3.4.5.>: Helo command rejected: invalid ip address; from= proto=SMTP helo=<1.2.3.4.5.> 501 5.5.2 <1.2.3.4.5.>: Helo command rejected: invalid ip address >>> # >>> # The defer restriction >>> # >>> defer_code 444 OK >>> helo_restrictions defer OK >>> helo foobar ./smtpd_check: : reject: HELO from foo[131.155.210.17]: 444 4.3.2 : Helo command rejected: Try again later; from= proto=SMTP helo= 444 4.3.2 : Helo command rejected: Try again later