How to make postfix not RBL-check on port 587?

[HostaHost]

We've begun deploying postfix instead of qmail on new servers but have run into an issue. We use several RBL's and on a Plesk qmail install, RBL checking is only done on port 25 because that's the only port it needs to be on. Qmail installs do not test for RBL listings on port 587 connections since port 587 only accepts authenticated SMTP anyway.

On the postfix servers, they appear to be doing the RBL test on both 25 and 587. This prevents customers whose internet providers have some blacklisted address space from sending outgoing email through our servers at all.

Is there a way make postfix's SMTP listener behave the way Plesk would set up the xinetd listener on a qmail install so that it does not do RBL checking on port 587?

 

[Faris Raouf]

Take a look at this (which is in the Plesk 9 section): http://forum.parallels.com/showthread.php?t=100849

Also do a quick google for "postfix rbl port 587" -- you'll find your post but also a few others that might help.

As I don't use Postfix I really can't comment, but I would have expected this issue to have been fixed in 10 or at least in 11? But maybe it has and you are being hit by a different issue somehow?

 

[HostaHost]

Good tip Faris, thanks. So yes, it seems this is a bug in Plesk's generation of the main.cf file. Here is the default (with the two RBL's we chose to use added via the web interface):

smtpd_client_restrictions = permit_mynetworks, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org

and this is the corrected version:

smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org

Postfix works in a first match wins method, so the corrected version still permits relay if it's a local IP but then doesn't test further. If that did not match, it permits the connection if SMTP auth is used and doesn't check further. Then it rejects if the connection is from an IP on either RBL we've defined. If it is not rejected, the connection is allowed to continue like normal but only to a local recipient.

Postfix's own authentication examples include the permit_sasl_authenticated in the client restrictions so I'm not sure why Parallels left that out:

http://www.postfix.org/SMTPD_ACCESS_README.html