1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

How to make postfix not RBL-check on port 587?

Discussion in 'Plesk 10.x for Linux Issues, Fixes, How-To' started by Hostasaurus.Com, Feb 6, 2013.

  1. Hostasaurus.Com

    Hostasaurus.Com Regular Pleskian

    30
    68%
    Joined:
    Oct 8, 2009
    Messages:
    465
    Likes Received:
    8
    We've begun deploying postfix instead of qmail on new servers but have run into an issue. We use several RBL's and on a Plesk qmail install, RBL checking is only done on port 25 because that's the only port it needs to be on. Qmail installs do not test for RBL listings on port 587 connections since port 587 only accepts authenticated SMTP anyway.

    On the postfix servers, they appear to be doing the RBL test on both 25 and 587. This prevents customers whose internet providers have some blacklisted address space from sending outgoing email through our servers at all.

    Is there a way make postfix's SMTP listener behave the way Plesk would set up the xinetd listener on a qmail install so that it does not do RBL checking on port 587?
     
  2. Faris Raouf

    Faris Raouf Silver Pleskian Plesk Guru

    31
    30%
    Joined:
    Mar 15, 2009
    Messages:
    667
    Likes Received:
    17
    Take a look at this (which is in the Plesk 9 section): http://forum.parallels.com/showthread.php?t=100849

    Also do a quick google for "postfix rbl port 587" -- you'll find your post but also a few others that might help.

    As I don't use Postfix I really can't comment, but I would have expected this issue to have been fixed in 10 or at least in 11? But maybe it has and you are being hit by a different issue somehow?
     
  3. Hostasaurus.Com

    Hostasaurus.Com Regular Pleskian

    30
    68%
    Joined:
    Oct 8, 2009
    Messages:
    465
    Likes Received:
    8
    Good tip Faris, thanks. So yes, it seems this is a bug in Plesk's generation of the main.cf file. Here is the default (with the two RBL's we chose to use added via the web interface):

    smtpd_client_restrictions = permit_mynetworks, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org

    and this is the corrected version:

    smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org

    Postfix works in a first match wins method, so the corrected version still permits relay if it's a local IP but then doesn't test further. If that did not match, it permits the connection if SMTP auth is used and doesn't check further. Then it rejects if the connection is from an IP on either RBL we've defined. If it is not rejected, the connection is allowed to continue like normal but only to a local recipient.

    Postfix's own authentication examples include the permit_sasl_authenticated in the client restrictions so I'm not sure why Parallels left that out:

    http://www.postfix.org/SMTPD_ACCESS_README.html
     
Loading...