Re: [exim] require_verify = sender + RBLs - clarification on…

Alon wrote:
> Hi All,
>
> I'm trying to understand what would be the impact of enabling:
>
>
> # require_verify = sender
>
*snip*

There are long threads on pros, cons, etc. in recent archives here.
Check those and the Exim 4.6X spec.

>
> How would this line affect the usage from my users:

As ordinarily implemented, it should not affect MUA submissions at all.

> 2. Users who use forms on the server and use localhost and do not use SMTP full credentials,...

Separate environment, and this is not the tool.
You might want to look at 'check_local', but you will need *many* tools to keep
webforms under control.

>
> 3. Users from Outside the server...

'Strangers' sending messages to your user community are the principle group
affected.

verify = sender tries to see if the 'incoming' mail server of-record for the
domain they *apear* to come from both exists and accepts *at least* a partial
attempt to send mail. Many malware sources will fail that. Further options in
the spec.

>
> 4. Question number 3, .... dramatically less spam

Yes, BUT - if used as 'require' you will almost certainly have loss of other
mail as well.

>
> 5. If this is such a good feature, why would it be disabled...

- Not all sender's servers can/do respond properly or promptly to the query.

- Some very large / major ISP's do not have usable DNS records for their 'pools'
of servers.

- Many operators do not appreciate being hit with the query.

- A few may even blacklist those who attempt such queries.

Feature is perhaps at its best when used within a known-responsive environment -
say one company's intranet or a 'pool' of MX or relay hosts.

hosts / !hosts and hostlists or lookups can be used to specify which/which-not
to apply it to if you choose to use it.

Bill