Postfix NOQUEUE: rejeitar: RCPT de desconhecido

Question

Eu construí um aplicativo baseado na web, mas quando ele está tentando enviar um e-mail, ele falha. O postfix registra o seguinte em seu mail.log:

    postfix/smtpd[22261]: warning: hostname srv.eastinc.nl does not resolve to address 192.168.3.101
    postfix/smtpd[22261]: connect from unknown[192.168.3.101]
    postfix/smtpd[22261]: NOQUEUE: reject: RCPT from unknown[192.168.3.101]: 554 5.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<domain.eastinc.nl>
    postfix/smtpd[22261]: disconnect from unknown[192.168.3.101]

Tenho certeza que srv.eastinc.nl resolve 192.168.3.101, porque o nslookup diz isso. Configuração do postfix:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
delay_warning_time = 2h
home_mailbox = Maildir/
inet_interfaces = all
mailbox_size_limit = 0
mydestination = eastinc.nl, mail.eastinc.nl, srv.eastinc.nl, localhost.eastinc.nl, localhost
myhostname = mail.eastinc.nl
mynetworks = localhost 192.168.3.101 127.0.0.1 srv.eastinc.nl
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relayhost = smtp.ziggo.nl:25
smtp_always_send_ehlo = yes
smtp_sasl_auth_enable = no
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_cert_file = /etc/ssl/certs/mailcert.pem
smtpd_tls_key_file = /etc/ssl/private/mail.key
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes

Se eu entendi isso corretamente, tanto 192.168.3.101 quanto srv.eastinc.nl devem ser capazes de retransmitir mensagens através do Postfix. Alguma idéia de como fazer isso funcionar?

    

Answer 1

Você tem as seguintes restrições na sua configuração:

smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain

permit_sasl_authenticated

Permit the request when the client is successfully authenticated via the RFC 4954 (AUTH) protocol.

reject_unauth_destination

Reject the request unless one of the following is true:

• Postfix is mail forwarder: the resolved RCPT TO domain matches $relay_domains or a subdomain thereof, and contains no sender-specified routing (user@elsewhere@domain),

• Postfix is the final destination: the resolved RCPT TO domain matches $mydestination, $inet_interfaces, $proxy_interfaces, $virtual_alias_domains, or $virtual_mailbox_domains, and contains no sender-specified routing (user@elsewhere@domain).

reject_unknown_sender_domain

Reject the request when Postfix is not final destination for the sender address, and the MAIL FROM domain has 1) no DNS MX and no DNS A record, or 2) a malformed MX record such as a record with a zero-length MX hostname (Postfix version 2.3 and later).

The reply is specified with the unknown_address_reject_code parameter (default: 450), unknown_address_tempfail_action (default: defer_if_permit), or 550 (nullmx, Postfix 3.0 and later). See the respective parameter descriptions for details.

Então, meu palpite é: quem se conecta de 192.168.3.101 host (é o próprio servidor?) enviando mensagens sem autenticação (não há nada sobre autenticação no log). Então você precisa da seguinte restrição para fazer isso:

permit_mynetworks

Permit the request when the client IP address matches any network or network address listed in $mynetworks.

Prefira smtpd_recipient_restrictions com permit_mynetworks .

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination

Documentos oficiais: ACESSO README

UDP

Às vezes é muito ruim para permit_mynetworks , porque qualquer host de $mynetworks pode enviar e-mails sem autenticação.

Então é melhor enviar e-mails via smtp com auth do seu aplicativo e não usar sendmail()/mail() functions