Postifx should not allow Backscatter

[jassonmc]

Hi all

Since OPNsense and it's postifx plugin act as a mail gateway and not as a final destination, it should not allow for backscatter mail.

That is; it should not accept inbound mails for recipients which do not exist on the final destination mail server.

Postfix does have a setting for that:

smtpd_recipient_restrictions =
       reject_unverified_recipient

That setting tells the OPNsense postfix to not yet accept that inbound mail, but first check with the internal destination mail server if that recipient would be accepted. If yes, it will happily accept that inbound mail (when it passed all other tests ofc). If not, it will send a 5xx response and therefore actively not contributing to backscatter.

Is there a way to add that setting to the main.cf or does that require a plugin update?

There is an option in the GUI called "Enforce Recipient Relay Check", which sounds similar, but requires you to feed the "Recipients" in the postfix plugin manually, which seems to me quite error prone.
Postfix can do this automatically, no need to feed an outer postifx with acceptable recipients.

It would help tremendously if one would be able to have a custom script block in order to proivde more options for the main.cf, like the one mentioned above. That way we could also easily add custom block lists and more, if necessary.

Any input is welcome.

[Fright]

as far as I understand the idea is not to allow the user to kill the opnsense with arbitrary settings (" custom script block").

but imho
reject_unverified_recipient is really desired option

im using postfiх on separate host and if i deсide to use postfix on opnsense host, i will pull request to add this option to GUI\.cf
https://github.com/opnsense/plugins/pulls