Contents

Greylisting mail from frequently forged domains

It is relatively safe to turn on greylisting for specific domains that often appear in forged email. At some point in cyberspace/time a list of frequently forged MAIL FROM domains could be found at http://www.monkeys.com/anti-spam/filtering/sender-domain-validate.in.

 1 /etc/postfix/
main.cf:
 2     
smtpd_recipient_restrictions =
 3         
reject_unlisted_recipient
 4         ...
 5         
reject_unauth_destination 
 6         
check_sender_access hash:/etc/postfix/sender_access
 7         ...
 8     
smtpd_restriction_classes = greylist
 9     greylist = 
check_policy_service unix:private/policy
10 
11 /etc/postfix/sender_access:
12     aol.com     greylist
13     hotmail.com greylist
14     bigfoot.com greylist
15     ... etcetera ...

NOTES:

• Line 9: On Solaris you must use inet: style sockets instead of unix: style, as detailed in the " Example: greylist policy server" section above.

• Line 6: Be sure to specify " check_sender_access" AFTER " reject_unauth_destination" or else your system could become an open mail relay.

• Line 3: With Postfix 2.0 snapshot releases, " reject_unlisted_recipient" is called "check_recipient_maps". Postfix 2.1 understands both forms.

• Line 3: The greylist database gets polluted quickly with bogus addresses. It helps if you protect greylist lookups with other restrictions that reject unknown senders and/or recipients.