Post by @waider@mastodon.ie

2026-06-29 20:37 UTC

@jjcelery@mastodon.ie spent a good deal of time fighting this specific demon with Postfix, and eventually resorted to writing a validation script and reading through settings until I _think_ I have it nailed. The only gap currently is questionable relays (i.e. someone sends email relay.doofus.com "from" and "to" me, and my server accepts it) and the only way I know of to kill this is to be brutal about SPF/DKIM. I have this on a test server and it seems to work. Will post config snippet in followup.

Replies (2)

@ithoughtisawa2@infosec.exchange 2026-06-29 20:43

@waider@mastodon.ie @jjcelery@mastodon.ie I was going to say the same thing. This is exactly the problem SPF, DMARC and DKIM was designed to solve, validating that mail sent using your domain is only sent from servers you have authorized to do so. The last step is for you to configure your server to reject messages that fail these tests

Open ##3477338
@waider@mastodon.ie 2026-06-29 20:42

smtpd_tls_auth_only=yes smtpd_sasl_auth_enable=yes smtpd_sasl_security_options=noanonymous smtpd_sender_login_maps=hash:/etc/postfix/sender_login_maps smtpd_sender_restrictions=permit_sasl_authenticated,reject_sender_login_mismatch, permit smtpd_recipient_restrictions=permit_sasl_authenticated,reject_unauth_destination echo "${USER}@${DOMAIN} ${USER}" >> /etc/postfix/sender_login_maps postmap /etc/postfix/sender_login_maps

Open ##5422820