Postfix Relay Control

Post on 23-Nov-2015

4 views 3 download

Transcript of Postfix Relay Control

Postfix relay controlThe default installation allows any system on the same subnet as yours to relay mail throughyour mail server. If you want to override the default, you can set the parameter mynetworksto be a list of hosts or networks that you trust to relay mail through your system. You canspecify a list of IP addresses or network/netmask patterns, and any connecting SMTP clientthat matches will be allowed to relay mail. You can list network or IP addresses that resideanywhere. So, for example, if you want to be able to relay mail through your home Postfixsystem from your work machine, you can specify the IP address of your machine at work inyour home Postfix configuration.Here's an example that allows mail from the local subnet (192.168.75.0/28) and a single hostlocated elsewhere:mynetworks = 192.168.75.0/28 10.150.134.15If you want to allow relaying for mobile users that do not have static IP addresses, you have touse some kind of SMTP authentication mechanism. Postfix can work with SASLAuthentication (which requires that Postfix be compiled with additional libraries, and thatusers' client software be specially configured) and pop-before-smtp (which requires a POPserver running on the same system to first authenticate users).It is important not to open relay access to anyone except users you trust. In the early days ofthe Internet, open relays were commonplace. Unfortunately the current prevalence of spamhas precluded that kind of freedom. If your MTA is not protected, you leave yourself andother Internet systems vulnerable to abuse. Spammers constantly scan for open relays, and ifyou place one on the network, it is only a matter of time before it will be found. Fortunately,the default Postfix installation behaves correctly. However, if you make lots of changes toyour Postfix configuration (especially in setting up antispam controls, ironically), you mayinadvertently open yourself up to relay abusers.If you want your own Postfix installation to relay mail through another MTA, specify the IPaddress of the relay server using the relayhost parameter. Postfix normally figures outwhere to deliver messages on its own, based on the destination address. However, if yoursystem is behind a firewall, for example, you may want Postfix to hand off all messages toanother mail server to make the actual delivery. When you specify a relay server, Postfixnormally performs a DNS query to obtain the mail exchanger (MX) address for that system.You can override this DNS lookup by putting the hostname in square brackets:relayhost = [mail.example.org]