Postfix:使用 check_recipient_mx_access 时将路由应用于错误的收件人

Postfix:使用 check_recipient_mx_access 时将路由应用于错误的收件人

我正在使用 check_recipient_mx_access,这样我就可以将所有 office365 托管或 google 托管的域路由到一个特殊的电子邮件网关 [因为 SPF、DMARC 等等]。

smtpd_recipient_restrictions = ..., check_recipient_mx_access hash:/etc/postfix/mx_access,...

在 /etc/postfix/mxaccess 中

 .protection.outlook.com FILTER smtp:[IP.AD.DR.ESS]
 .google.com FILTER smtp:[IP.AD.DR.ESS]

这对于每个收件人都很有效,但当有多个收件人时有时会失败。

例如 sender@mydom 发送到 dest1@hotmail 和 dest2@mydom2,然后 dest2@mydom2 被中继到 [IP.AD.DR.ESS],这是错误的。

对于第一个收件人来说这是可以的,因为它的 MX 解析 something.protection.outlook.com,但对于第二个收件人来说不行,因为 mydom2 在 transport_maps 中有一个特殊的路由,在这种情况下不使用,并且因为它的 MX 不会在与 mxaccess 表匹配的东西中解析。

[如果仅 dest2@mydom2 作为收件人,则路由正常]

[如果有多个 @mydom2 @mydom3 dest,且没有匹配的 mxaccess,则路由正常]

注意:这是 ubuntu 上的 postfix 3.3.0。

postconf -M
smtp       inet  n       -       -       -       -       smtpd
pickup     fifo  n       -       -       60      1       pickup
cleanup    unix  n       -       -       -       0       cleanup
qmgr       fifo  n       -       n       300     1       qmgr
tlsmgr     unix  -       -       -       1000?   1       tlsmgr
rewrite    unix  -       -       -       -       -       trivial-rewrite
bounce     unix  -       -       -       -       0       bounce
defer      unix  -       -       -       -       0       bounce
trace      unix  -       -       -       -       0       bounce
verify     unix  -       -       -       -       1       verify
flush      unix  n       -       -       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
smtp       unix  -       -       -       -       -       smtp
relay      unix  -       -       -       -       -       smtp -o fallback_relay=
showq      unix  n       -       -       -       -       showq
error      unix  -       -       -       -       -       error
discard    unix  -       -       -       -       -       discard
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       -       -       -       lmtp
anvil      unix  -       -       -       -       1       anvil
scache     unix  -       -       -       -       1       scache
maildrop   unix  -       n       n       -       -       pipe flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
uucp       unix  -       n       n       -       -       pipe flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail     unix  -       n       n       -       -       pipe flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp      unix  -       n       n       -       -       pipe flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n       n       -       2       pipe flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman    unix  -       n       n       -       -       pipe flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}
retry      unix  -       -       -       -       -       error
policyd-spf unix -       n       n       -       0       spawn user=policyd-spf argv=/usr/sbin/postfix-policyd-spf-perl


~# postconf -n
alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
command_directory = /usr/sbin
compatibility_level = 2
debug_peer_level = 2
debugger_command = PATH=/usr/bin:/usr/X11R6/bin xxgdb $daemon_directory/$process_name $process_id & sleep 5
inet_interfaces = all
local_recipient_maps =
mail_owner = postfix
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 20480000
mydestination = $myhostname, localhost.$mydomain, penty.of.domains.tld
mynetworks = 172.16.0.0/16, 192.168.10.0/24, 127.0.0.0/8, 10.0.0.0/24
myorigin = /etc/mailname
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-1.1.12/README_FILES
recipient_delimiter = +
relayhost =
sample_directory = /usr/share/doc/postfix-1.1.12/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_recipient_restrictions = reject_invalid_hostname, check_recipient_mx_access hash:/etc/postfix/mxaccess, permit_mynetworks, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_non_fqdn_sender, check_recipient_access hash:/etc/postfix/recipientaccess, reject_unauth_pipelining, reject_unauth_destination, reject_unverified_recipient, check_sender_access hash:/etc/postfix/senderaccess, reject_unknown_sender_domain, reject_rbl_client sbl.spamhaus.org, reject_rbl_client psbl.surriel.com, reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl-3.uceprotect.net, check_policy_service inet:127.0.0.1:60000, check_policy_service unix:private/policyd-spf, permit
smtpd_relay_restrictions = reject_invalid_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, reject_unknown_sender_domain, reject_unauth_pipelining, reject_unauth_destination, check_recipient_access hash:/etc/postfix/recipientaccess, reject_unverified_recipient, check_sender_access hash:/etc/postfix/senderaccess, reject_rbl_client sbl.spamhaus.org, reject_rbl_client psbl.surriel.com, reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl-3.uceprotect.net, check_policy_service inet:127.0.0.1:60000, check_policy_service unix:private/policyd-spf, permit
smtpd_tls_cert_file = /etc/letsencrypt/live/XXXXXXXXXXXXXXX/fullchain.pem
smtpd_tls_ciphers = high
smtpd_tls_key_file = /etc/letsencrypt/live/XXXXXXXXXXXXXXX/privkey.pem
smtpd_tls_loglevel = 1
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
transport_maps = hash:/etc/postfix/transport
virtual_alias_domains = XXXXXXXXXX
virtual_alias_maps = regexp:/etc/postfix/virtual_re

答案1

对于第一个收件人来说这是可以的,因为它的 MX 解析 something.protection.outlook.com,但对于第二个收件人来说不行,因为 mydom2 在 transport_maps 中有一个特殊的路由,在这种情况下不使用,并且因为它的 MX 不会在与 mxaccess 表匹配的东西中解析。

我找到了这段文字:

  • 如果一条消息触发多个过滤操作,则只有最后一个操作会生效。
  • 相同的内容过滤器适用于给定邮件的所有收件人。

在:http://www.postfix.org/FILTER_README.html#dynamic_filter

相关内容