[SOLVED] postfix allows mail relaying for any random subdomains

vincix · 03-31-2020, 01:04 PM

I'm running a postfix send-only mail relay (postfix-3.4.5) with restrictions per IPs (my networks, that is to say) and a restriction for domains that can be used to send e-mails for.
The latter is being enforced using the following directive:

Code:

smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unknown_recipient_domain, check_sender_access hash:/etc/postfix/allowed_senders, reject

/etc/postfix/allowed_senders (already mapped to db)

Code:

domain.eu	OK
domain.com	OK
example.de	OK

The problem is that postfix also accepts the relay of e-mails for any random subdomains of these main domains and I haven't yet found a solution for rejecting this.
This works when I enforce login maps, for instance, so that certain users can send e-mails using only certain e-mail addresses, but this mail relay is configured differently and I would have expected being able to allow only the domains I'm specifying, and not any other subdomains.

Any ideas?

TB0ne · 03-31-2020, 04:11 PM

Quote:

Originally Posted by vincix

I'm running a postfix send-only mail relay (postfix-3.4.5) with restrictions per IPs (my networks, that is to say) and a restriction for domains that can be used to send e-mails for.
The latter is being enforced using the following directive:

Code:

smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unknown_recipient_domain, check_sender_access hash:/etc/postfix/allowed_senders, reject

/etc/postfix/allowed_senders (already mapped to db)

Code:

domain.eu	OK
domain.com	OK
example.de	OK

The problem is that postfix also accepts the relay of e-mails for any random subdomains of these main domains and I haven't yet found a solution for rejecting this.
This works when I enforce login maps, for instance, so that certain users can send e-mails using only certain e-mail addresses, but this mail relay is configured differently and I would have expected being able to allow only the domains I'm specifying, and not any other subdomains.

Seen this once before, but it's been a while. Run

Code:

postconf -n

...and see if the smtpd_access_maps directive is enabled. If so, remove it from your config and bounce postfix. Found in the postfix manual.
http://www.postfix.org/access.5.html

From that page:

Code:

domain.tld
              Matches domain.tld as the domain part of an email address.

              The pattern domain.tld also matches subdomains,  but  only  when
              the  string  smtpd_access_maps  is  listed  in  the Postfix par-
              ent_domain_matches_subdomains configuration setting.

vincix · 04-02-2020, 07:59 AM

Hi,

Thanks for the reply. It did work indeed by removing the smtpd_access_maps from the parent_domain_matches_subdomains:

Code:

parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains

It seems to also work by eliminating all the values:

Code:

parent_domain_matches_subdomains =

But to be honest, I can't understand exactly why. Would you happen to know why?

Thanks for the help, anyway, it solved the problem.