Configure PostFix to reject emails when nslookup ≠ ip

Hey Everyone,
I'm trying to configure postfix to reject messages that don't have the correct domain associeated with the ip address. From what I can tell so far i need to create a header_check file, and tell postfix to use it in main.cf. My only problem is I don't know what things I need to put in the header_check file. If any one has already done this, it would be much apprecieated if you could post it for all to see.
Thanks,
Eric
Dual 2.0 1.5Gb Raid O Mac OS X (10.4.3)

Eric,
by doing so you will block more mail than you really want. With the shortage of IP numbers, virtual hosting has become increasingly popular. Thus a single IP number is often being used for a large number of virtual domains. In those cases a reverse lookup will only be correct for one of those domains. This doesn't mean the mail is not legit.

Similar Messages

ARQ: How to configure Role Approve/Reject Email Notifications???

Hi,
I would like to achieve below for my business scenario with below MSMP stage configurations:
MSMS Stages Configurations:
MANAGER --> Can act on both request and line items level
Role Owner--> Can ONLY act on line items
Requirement
In best case, a Manager approves all the line items in an Access Request. Then an email notification mail for "NEW WORK ITEM" would be sent to Role Owner(s) at next stage. This is achieved.
Now at Role Owner Stage, below 3 cases are possible:
1. All Role Owners can approve the line items
2. All Role Owners can reject the line items
3. Some of the Role Owners approve and Some of them reject line items
In all the above cases, a Role Owner ALWAYS click on "SUBMIT" button (as he is not authorized to reject a request as a whole) and this action is considered to be as "APPROVED" and eventually, "APPROVED" event is triggered.
This looks good in case numbers: 1 & 3. Meaning, even a single role is approved, request can be considered as approved and the request details can be sent to business user.
However, I am facing a problem when ALL the line items are rejected by ALL the Role Owners!
This will surely close the request. However, the email notification that will be sent to user in this case will be of "APPROVED" though the request is rejected in a sense (because all the roles are rejected)!
Can anybody please he understand this and design proper solution?
Regards,
Faisal

Hi Faisal,
We are on GRC SP13.
Please do below settings to make role approval/rejection comments mandatory.
2040 - Set this parameter value as YES
In MSMP - Role Owner - Stage settings - Please maintain these settings
I have come across the same scenario as yours. Below is my observation.
When all role owners rejects all roles by REJECTING roles at LINEITEM level, request instead of getting closed at ROLE OWNER stage, it is going to next stage and getting closed there. I assume this is standard behaviour
Let's see if we can get experts advise on this.
Regards,
Madhu.

Alerts to email when Bex Broadcaster Failed

Hi Experts,
Currently we are broadcasting Business KPI reports to the users from SAP BI at a scheduled time.
These broadcast settings are based on webtemplate. Some times the broadcast setting which is scheduled will fail due to the most frequest errors like " Error while generating HTML" etc.
The issue is only temporary basis, next time the same error will not come and the issue is not reproducable.So is there a way we can configure the alerts to emails when the bex broadcast setting is failed.
Transaction to see logs of broadcast settings is RSRD_LOG.
Thanks & best regards,
Sudhakar.k

3 possible solutions that come to mind:
1. Write custom ABAP program that checks RSR_PREC_SETT table and sends email when report failed entry is made, and schedule program to run periodically
2. Create process chain that kick off Broadcaster report and would also notify if report has failed.
3. You can also schedule RSR_PREC_SETTINGS_RESTART with Current date variant to run periodically and this job will restart any failed broadcaster reports from that day (stored in table RSR_PREC_SETT)
Check out this article for additional information:
http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/30e3d697-4ca0-2c10-4b81-c474b1490064?quicklink=index&overridelayout=true
Hope it helps. Thank you.

Configure Postfix to allow a non fully-qualified hostname to send email

I have a Mushroom Networks Porcini box that sends notifications from email address bbna@bbna
When I set up the Porcini to send notifications to my email address using a Mac Mini running Snow Leopard Server the email session aborts:
macbookenet:~ pderby$ telnet red.pderby.com 25
Trying 208.37.99.226...
Connected to red.pderby.com.
Escape character is '^]'.
220 red.pderby.com ESMTP Postfix
HELO bbna
250 red.pderby.com
MAIL FROM:<bbna@bbna>
250 2.1.0 Ok
RCPT TO:<[email protected]>
504 5.5.2 <bbna>: Helo command rejected: need fully-qualified hostname
I would like to configure Postfix to accept mail from this MAIL FROM address as an exception, rejecting any other addresses that are not fully-qualified.
Is there a way to do that?
Thanks for any help!

Launch Terminal.app and buried in the usual postconf -n output for your host, you should find this line:
smtpd_helo_restrictions = reject_invalid_helo_hostname reject_non_fqdn_helo_hostname
If so, then edit it with the following two lines (that first line is one long line) to tweak that:
sudo postconf -e "smtpd_helo_restrictions = permit_mynetworks reject_invalid_helo_hostname reject_non_fqdn_helo_hostname"
sudo postfix reload
That will cause local hosts (from the mynetworks setting) to bypass the SMTP HELO check that's tripping your "underpowered" box here.

Configuring postfix on Mountain Lion Server

I'm trying to upgrade from Snow Leopard Server to Mountain Lion Server and did an install of Mountain Lion Server on top of a working instance of Snow Leopard Server. The "crippled" GUI on Mountain Lion Server is forcing me into using terminal to configure Postfix to handle incoming email.
I would like to configure Postfix to only accept email that is forwarded from a gmail business account. The public email address is [email protected] which is received by Google Mail, goes through their spam filters and then is auto-forwarded to [email protected]
The server WAN domain is nonpublic.com The ip address is 96.231.165.126
The server LAN is nonpublic.local The ip address is 10.6.18.201
The server is a MacMini running Mountain Lion Server 10.6.8 hostname server so the FQDN is server.public.com.
The network on the MacMini is configured to handle both LAN and WAN traffic through the 1GB physical ethernet port which plugs into a CISCO 3750 switch. The external traffic to the WAN flows through the switch as tagged packets. The LAN traffic is not tagged. The VLAN connection is running 802.1q
When an email is sent through the WAN to [email protected] the Postfix SMTP log shows:
Jun 7 19:29:22 server.public.com postfix/smtpd[42181]: connect from cisco.public.com[96.231.165.123]
Jun 7 19:29:22 server.public.com postfix/smtpd[42181]: disconnect from cisco.public.com[96.231.165.123]
I can send emails from a client on the LAN through this server with no problems. The incoming mail server can connect to the machine via the Cisco router/switch but Postfix just shows "cisco" as the connection (that's the router's DNS name) and provides no more info. I suspect Postfix possibly doesn't like the 802.1q connection and drops the SMTP request to connect on port 25.
I have turned on "debug" logging in Postfix, but that is all that appears in the SMTP log file
I've spent most of the week reading through everything I can find on how to install and configure postfix on Mountain Lion Server and work around the cripled GUI in the "server" application. I'm barely OK using Terminal and not familiar at all with configuring Postfix directling editing the config file.
What is the best approach to configure Postfix to allow SMTP connections from the outside to deliver incoming email that is forwarded from gmail.com?
I did find an "aliases" file in /etc/postfix/aliases but I'm not sure how to add the aliases and if adding aliases with a text editor is going to cause the "server" app problems and if the changes will be lost when the machine is restarted.
Any help would be appreciated.

MrHoffman, thank you for your response to my challenge to get the new test server working. This is a migration from Snow Leopard Server to Mountain Lion Server.
Here is the "checkhostname" test results:
blue:~ admin$ sudo changeip -checkhostname
Password:
Primary address     = 96.231.165.211
Current HostName    = blue.pderby.com
DNS HostName        = blue.pderby.com
The names match. There is nothing to change.
dirserv:success = "success"
blue:~ admin$
Here is the response from postconf -n
blue:~ admin$ postconf -n
biff = no
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin xxgdb $daemon_directory/$process_name $process_id & sleep 5
dovecot_destination_recipient_limit = 1
html_directory = /usr/share/doc/postfix/html
imap_submit_cred_file = /Library/Server/Mail/Config/postfix/submit.cred
inet_interfaces = loopback-only
inet_protocols = all
mail_owner = _postfix
mailbox_size_limit = 0
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
message_size_limit = 10485760
mydomain_fallback = localhost
newaliases_path = /usr/bin/newaliases
queue_directory = /Library/Server/Mail/Data/spool
readme_directory = /usr/share/doc/postfix
recipient_delimiter = +
sample_directory = /usr/share/doc/postfix/examples
sendmail_path = /usr/sbin/sendmail
setgid_group = _postdrop
smtpd_tls_ciphers = medium
smtpd_tls_exclude_ciphers = SSLv2, aNULL, ADH, eNULL
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
use_sacl_cache = yes
blue:~ admin$
I agree that I should change the LAN domain from .local to something like .internal or whatever.   I've been running with .local for 5 years on snow leopard server and never had any problems so that was a low priority.
I hope I'm just not seeing some obvious setting in main.cf

Configure postfix to accept inbound mail only from Google

I like to host my own email on a Mac Mini running OS X Server. I’ve also looked for solutions that allow filtering out SPAM before the mail gets sent to my server. For many years I used Postini’s spam filtering service to clean incoming email before Postini forwarded the mail on to my server. I now use Google mail, part of Google Apps service to remove spam and to archive all the mail.
The approach of letting Google clean emal before sending the mail on to my OS X Server uses two domains, one a “public” domain for incoming email and another a “private” domain used only for forwarding the filtered email to OS X server.
All went well with the defult Postfix configuration that came with OS X Server for a few months, then SPAM started creeping into my “private” domain as various spammers discovered my private email address and started sending mail directly to the Mac Mini, bypassing Google.
Whenever I had spare time I would search the web looking for how to configure Postfix on OS X server so that email from Google and my other machines would be accepted and all other email would be blocked. There were lots of write-ups on how to relay outgoing email to Google, but I couldn’t find straightforward configuration instructions for configuring Postfix to only allow incoming email forwarded by Google or coming from my machines and block all other sources.
With a Google apps account you get telephone support so I gave Google a call and within a few rings got a very pleasant guy who listened to what I wanted to do and didn’t have the configuration setup, but did offer to send me a document showing the blocks of IP addresses used by Google for sending email.
I’ve posted several requests for help doing this type of configuration and never received responses that made sense. So in the interest of helping anyone else that wants to configure Postfix to accept connections from a set of specific IP addresses and refuse connections from all other connections for inbound email, here is what will get you going:
Use your favorite text editor to edit the Postfix configuration file (I use BBEDIT) but use whatever you like.
On the OS X Server open this file:
/Library/Server/Mail/Config/postfix/main.cf
Immediately do a “save as…” to make a backup copy with a different name, such as …mail.df.back1 in the same directory so you can revert to the backup if necessary.
substitute your domain names in the following commands:
public.com   - change to your publicly advertised routable domain
hidden.com - change to your OS X Server routable domain
lan.com - change to your OS X Server lan domain, should be registered to make things clean and shouldn’t be .local
10.6.18.0/24 - change to your LAN subnet
host - change to your host name
Your Postfix configuration file should contain these commands (and probably more). Each situation varies so do what you have to for your situation….
Have Postfix add your public domain name in the email header
myorigin = public.com
mydomain_fallback = localhost
message_size_limit = 41943040
biff = no
aaa.bbb.ccc.ddn - Your publicly routable IP addresses provided by your ISP
Let Postfix know your LAN network, the routable addresses you have from your ISP, and the Google networks where the Google email servers live. Get the latest list of Google networks hosting email at this address: https://support.google.com/a/answer/3070269
mynetworks =
          10.6.18.0/24,
          127.0.0.0/8
# ISP provided routable IP Addresses, individually or cidr aaa.bbb.ccc.0/24 notation if possible
          aaa.bbb.ccc.dd1,
          aaa.bbb.ccc.dd2,
          aaa.bbb.ccc.dd3,
          aaa.bbb.ccc.dd4,
# Google networks
          64.18.0.0/20
          64.233.160.0/19
          66.102.0.0/20
          66.249.80.0/20
          72.14.192.0/18
          74.125.0.0/16
          173.194.0.0/16
          207.126.144.0/20
          209.85.128.0/17
          216.239.32.0/19
smtpd_client_restrictions =
          permit_mynetworks
          permit_sasl_authenticated
# Comment out the spam blacklist sites since Google does spam filtering for you
#          reject_rbl_client bl.spamcop.net
#          reject_rbl_client zen.spamhaus.org
#          permit
# If you get this far, reject because the IP address isn’t one of yours or Google’s
          REJECT
The rest of the config file should be pretty much what you already have in place
recipient_delimiter = +
smtpd_tls_ciphers = medium
inet_protocols = all
inet_interfaces = all
config_directory = /Library/Server/Mail/Config/postfix
smtpd_enforce_tls = no
smtpd_use_pw_server = yes
relayhost =
smtpd_tls_cert_file = your cert file path here
mydomain = hidden.com
smtpd_pw_server_security_options = cram-md5,digest-md5,login,plain
smtpd_sasl_auth_enable = yes
smtpd_helo_required = yes
smtpd_tls_CAfile = your file path here
content_filter = smtp-amavis:[127.0.0.1]:10024
smtpd_recipient_restrictions =
     permit_mynetworks,
     permit_sasl_authenticated,
     check_policy_service unix:private/policy,
     reject_unauth_pipelining,
     reject_invalid_hostname,
     reject_unauth_destination,
     reject_unknown_recipient_domain,
     reject_non_fqdn_recipient,
     permit
header_checks = pcre:/Library/Server/Mail/Config/postfix/custom_header_checks
myhostname = host.hidden.com
smtpd_helo_restrictions = reject_non_fqdn_helo_hostname reject_invalid_helo_hostname
smtpd_use_tls = yes
smtpd_tls_key_file = your path here
enable_server_options = yes
recipient_canonical_maps = hash:/Library/Server/Mail/Config/postfix/system_user_maps
virtual_alias_maps = $virtual_maps hash:/Library/Server/Mail/Config/postfix/virtual_users
virtual_alias_domains = $virtual_alias_maps hash:/Library/Server/Mail/Config/postfix/virtual_domains
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, ipv6.$mydomain, public.com
mailbox_transport = dovecot
postscreen_dnsbl_sites = zen.spamhaus.org*2
maps_rbl_domains =
This config file should do the job of keeping out everyone but the Google email servers and devices on your WAN and LAN.
Any suggestions to make this better or more efficient welcomed!

After a few telnet tests I can answer my own question: It makes an open relay server to spammers! But to solve the former issue with the connection refuse, I had to switch to virtual hosting in the advanced tab of the mail service and add my own domains.

OS X Server rejects emails with empty subject

OS X Server rejects email that has empty subjects. This is not bad in itself, but several clients have complained that their emails have been rejected by the sever because there was no subject specified in the email.
Is there any command line setting that would configure this?
Thanks
Jeff

Hi Tony,
Thanks for the help.
I followed your instructions. However, the problem seems to persist with a test email that I sent out.
Here is the error message:
This report relates to a message you sent with the following header fields:
Message-id: <[email protected]>
Date: Wed, 19 Sep 2012 15:14:55 +0200
From: Jeffrey Hargrove <[email protected]>
To: Jeff Hargrove <[email protected]>
Subject:
Your message cannot be delivered to the following recipients:
Recipient address: [email protected]
Reason: SMTP transmission failure has occurred
Diagnostic code: smtp;550 5.7.1 empty subject header
Remote system: dns;mail.jeffhargrove.com (TCP|17.172.220.239|64701|212.198.87.10|25) (server.jeffhargrove.com ESMTP Postfix)
I noticed that the line in the custom_headers_check is not exactly what you indicated in your post. The one on my system is:
/^subject: *$/ REJECT empty subject header
I did verify that there is a hash before the line after quitting and restarting and the hash is still there.
I'm assuming that this is my server error and not my isp's doing. I sent an email with an empty subject from gmail using a browser and got the rejection notice.
Do you have any other ideas?
Thanks
Jeff

I changed my sim on my iPhone n reconfigured iMessage, it configured with my number but when i sign in with my apple id it says username/password is wrong while in all other things like FaceTime, App Store it worked with the same id and password

i changed my sim on my iPhone n reconfigured iMessage, it configured with my number but when i sign in with my apple id it says username/password is wrong while in all other things like FaceTime, App Store it worked with the same id and password..
can anyone help me to solve this issue

i just opened my ipad, started my apple account/I.D. and realized I put the wrong e mail. I was having trouble correcting my I.D on the Ipad so I went to my laptop and make the proper changes/slash e mail address I wanted for my apple ID. I got back to my ipad and try to download an app I can't because I have to sign in my apple account and I can't because it still has the irrelivant I.D/email address..
So, i did what you said.. went to setting>app store> tapped on my e mail.. it asked me to sign in (with my invalid emails address showing). I signed in with the password I had created. It said "incorrect".. I went to reset password. I reset password, tried to sign in and it says again "unvalid password".. this is getting irritating. I have been asking and no one knows what to do.

[SOLVED] Help needed to configure postfix

I aim to be able to manage myself my mailserver.
For now i just need help in order to configure postfix so i can send an email from my postfix configured mail to my gmail account.
I've read the following wiki pages :
https://wiki.archlinux.org/index.php/postfix
https://wiki.archlinux.org/index.php/Si … ail_System
Wich are really not informative.
I've my own domain name, wich can be pinged, i will call it : domain.free.fr
Here is what i've done so far :
Install postfix :
sudo pacman -S postfix
Configure myhostname in /etc/postfix/main.cf
myhostname = domain.free.fr
Configure the username in /etc/postfix/aliases
root: glow
Reload aliases and postfix
newaliases
postfix reload
postfix status
postfix/postfix-script: the Postfix mail system is running: PID: 11706
Then i've tried to use sendmail to send an email to my gmail adress :
sendmail [email protected]
Test
Nothing coming in my mail.
What do i do wrong ?
Ican't find any log about postfix, /var/log/mail.log do not exist, is this normal ?
Last edited by GloW_on_dub (2014-03-31 15:45:54)

mailq
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
CCD29FF253 262 Mon Mar 31 16:58:37 [email protected]
(delivery temporarily suspended: connect to alt4.gmail-smtp-in.l.google.com[74.125.25.27]:25: Connection timed out)
[email protected]
-- 0 Kbytes in 1 Request.
My mail is in the queue, but cannot be delivered
Last edited by GloW_on_dub (2014-03-31 15:03:51)

Need steps to configure Postfix in Mac 10.6.4

Hello,
I am working on a project where I need a local smtp server, and I want to use inbuilt postfix on my Mac. How can I configure postfix server on my Mac that allows me to send/receive emails from the machines on the same subnet?
Thanks for all the help..
varya

[Postfix Documentation|http://www.postfix.org/documentation.html]
most of the configuration documentation is also on your system under the directory
/usr/share/doc/postfix
Message was edited by: Nils C. Anderson

Rejected email notification are not generated in CUP 5.3

Dear Experts,
The rejected emails are not getting delivered to the user in a particular scenario. Below is my scenario where the email is not generated
1) The request has two roles with two role owners / BDOs
2) The rejected email delivered if the manager rejects the request
3) the rejected email is not delivered if one of the bdo rejects the request first and then the other BDO approves the request later.
4) The rejected email is delivered to the user if one of the BDO approves first but the other BDO rejects only after the first BDO approved the request.
Our conclusion is that the rejected email will be delivered only the last BDO rejects the request but we want the email delivered at any level.
We are looking for some solution for the step 3 in the above mentioned steps. Any help or solution is appreciated.

Varma,
You have two approvers in the same stage (BDO) whereas manager stage has only one approver. Whenever manager approvers/rejects there is noone else changing the approval and it goes to next stage. In the next stage (BDO), anyone approver can change the approval before it gets routed to the next stage. Can you check the rejection level setting in the BDO stage configuration? If you set the rejection level to request instead of role, this should reject and close the request and CUP will send the email notification.
Regards,
Alpesh

Automatic email when an alert occurs (RZ20) from SAP R/3 4.0B

Hi SAP Experts.
How do I configure the Automatic email when an alert occurs (RZ20) in the system SAP R/3 version 4.0B (AIX +Oracle) ?
Best regards.
Luis Gòmez

Hi Luiz
check this out
Note 429265 - CCMS monitor architecture: Central auto-reaction
Note 176492 - Automatic email when an alert occurs (RZ20)
SAP Note 939616 - CCMS auto-reactions: Help with Troubleshooting
Check SAP Note 617547 - RZ20: Sending alerts as mail and SMS
https://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/30237989-0901-0010-70a4-944691eb5e52 [original link is broken]
Setting Up your Central Monitoring [original link is broken]
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/106a4d88-2a36-2c10-549b-dc549d00b8b9
Read SAP Note 522878 - iSeries: Availability of CCMS Agents
Regards
Uday

Rejecting emails to unknown virtual users before filtering them?

hi
it appears that all emails to any virtual domain on my server gets "filtered" BEFORE it gets checked against valid users for that domain.
1. mail in
2. filtered
3. checked if valid
4. rejected (unknown)
Is there any way to have the validity check done before the filtering?
It would seem more economical if it worked like this...
1. mail in
2. checked if valid
3. rejected (unknown)
Regan
Message was edited by: reganyelcich

I have used pterobyte's virtual mail set up in the past without a problem - and found that Apple has broken the postfix in 10.5 (as it says on the PDF that pterobyte is recommending.)
If you, like me, had already set up each user in WGM to have two shortnames (the second one - an email at virtual domain) then you only need to append the users to your "virtual" file in "/etc/postfix".
EG:
[email protected] shortname
do this for each virtual user, postmap the file and reload postfix. Then the mail server will accept the email addressed to your virtual user.
By All Means: read the PDF for more instructions.

Savemail: cannot save rejected email anywhere

Hi folks...
When I run dmesg I see lots of sendmail errors that state "savemail: cannot save rejected email anywhere". I found a document at "http://sunsolve.sun.com/search/document.do?assetkey=1-9-83988-1" that indicates the if I run "/usr/lib/sendmail root@localhost </etc/motd
" it will produce the cannot save messages.
The forum document indicates that this errors may have something to do with the hosts.deny hosts.allow files. But under the /etc there is only the symbolic link to the hosts file.
So can anyone advise me on if I have to create the hosts.allow and/or hosts.deny files what entries in either file will stop the cannot save error messages?
On our Solaris 10 O/S I couldn't find those other hosts.* files.
Thanks in adavnce
Roger Sager, Sydney
please email me at [email protected]
Cheers

the first hit on google will reveal the answer.
alan

Since upgrading to Mavericks, Mail is extremely slow to load preview pane or show email when mailbox is double-clicked. Is this a known issue?

Since upgrading to Mavericks, Mail is extremely slow to load the preview pane or show email when mailbox is double-clicked. Is this a known issue? Or is there a solution to this issue?

Hi AngieLynch,
Thanks for visiting Apple Support Communities.
It sounds like you're seeing some unexpected behavior in Mail.
Before troubleshooting on your computer, I'd strongly recommend backing up your data to an external hard drive with Time Machine, if you haven't already. This article can help with setting up Time Machine:
Mac Basics: Time Machine backs up your Mac
http://support.apple.com/kb/ht1427
Next, try creating a new user account on your computer. You can add your email account to Mail in the new user account. If Mail is more responsive in the new user account, then Mavericks is working fine and the behavior is caused by conflicts in your own Mail or user account.
These articles walk you through creating a new user and setting up Mail:
OS X Mountain Lion: Create a new user account (applies to Mavericks, too.)
http://support.apple.com/kb/PH11468
Configuring Mail for your email account
http://support.apple.com/kb/HT1277
Best,
Jeremy

Configure PostFix to reject emails when nslookup ≠ ip

Similar Messages

Maybe you are looking for