Received wisdom says to me:
(1) Instead of rejecting MAIL FROM, reject all the following RCPT
commands. You get better logging to help tracking down problems, and you
don't prematurely reject attempts to contact postmaster.
(2) When being a submission server it's better to accept and bounce than
to reject RCPT commands at SMTP time, because submission clients (MUAs)
are not good at dealing with partial success.
In order to be able to bounce, we require a valid reverse path on all
messages, including those coming from submission clients. If this fails we
reject all the RCPT commands according to (1) above. However (2) then
comes back to bite us. Consider the following example:
220 ppsw-0.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.150]:587) ESMTP Exim 4.34 Wed, 30 Jun 2004 12:29:17 +0100
ehlo cyan.csi.cam.ac.uk
250-ppsw-0.csi.cam.ac.uk Hello cyan.csi.cam.ac.uk [131.111.10.17]
250-SIZE 10485760
250-PIPELINING
250-STARTTLS
250 HELP
mail from:<invalid.address@???>
250 OK
rcpt to:<fanf2@???>
550-Verification failed for <invalid.address@???>
550-"invalid.address@???" is not a known user on this system.
550 Invalid sender address: Sender verify failed
data
503 valid RCPT command must precede DATA
quit
221 ppsw-0.csi.cam.ac.uk closing connection
When certain MUAs attempt something like the above, they report to the
user "503 valid RCPT command must precede DATA" instead of the useful
error message which was given in response to RCPT. This is a dreadful
waste of my efforts to produce helpful error messages.
I note that the message submission RFC (2476) recommends rejecting invalid
reverse paths immediately after the MAIL FROM command, so perhaps doing
that will improve the behaviour of MUAs.
How are other people configuring their servers? Have you encountered this
problem?
Tony.
--
f.a.n.finch <dot@???>
http://dotat.at/
BAILEY: SOUTHWEST BECOMING CYCLONIC 4 OR 5, OCCASIONALLY 6. RAIN OR SHOWERS.
MODERATE OR GOOD.
