Home / server / Questions / 1036585
In Process
Peter
Asked: 2020-10-07 02:11:38 +0800 CST

Spamassasin disable Email from external to all groups except

  • 772

I would like to have a spamassasin rule that by default disables all external Emails to groups with exclusion of only a few groups. Thus [email protected] should not be able to [email protected]. While internal users should be able to those groups.

Only some group address should be possible for external usage [email protected] is allowed to email [email protected].

spamassassin

1 Answers

  1. Entirely misdirected mail (or even, for the outside world, nonexisting addresses) is a separate concept from spam. This is generally not something you want to skew your spam filtering metrics - so let the mail server reject them.

    For postfix, you probably want to utilize the fact that the right hand side of access maps can lead to another lookup:

    1. Insert a map declaring what is a restricted recipient
    smtpd_recipient_restrictions =
 [..]
 reject_non_fqdn_recipients
 check_recipient_access pcre:/etc/postfix/access_recipient.pcre
 [..]
    1. Add a new restrictions class defining who can email those restricted addresses
        smtpd_restriction_classes =
     smtpd_restriction_sender_internal
     [..]
    smtpd_restriction_sender_internal =
     check_recipient_access pcre:/etc/postfix/maps/access_sender_internal.pcre
    1. Define who is a rectricted recipient in /etc/postfix/access_recipient.pcre:
        /SalesTeam@internal\.example$/  DUNNO
    /receives.external@internal\.example$/  DUNNO
    /@internal\.example/                    smtpd_restriction_sender_internal
    1. Define who can email those recipients in /etc/postfix/maps/access_sender_internal.pcre
        /@internal\.example$/                         DUNNO
    /can.send.from.external@partner\.example$/    DUNNO
    /./                                           DEFER 4.2.0 Internal Recipient

    Note that the order of smtpd_recipient_restrictions matters here - if you were to order any whitelisting mechanism before the new access lookup, it would be circumvented. Note also that this filters based on sender - if you for some reason accept external mail claiming to be originating from you, then filtering based on permit_sasl_authenticated or permit_mynetworks may be more appropriate, lest the otherwise restricted groups can be sent mail to if merely claiming to be an internal sender.

    • 0