Re: Bad-Clients: definitely not working

After much experimenting, I conclude this is the algorithm used by TCPIP
anti-spam features:

bad clients are rejected IF _ANY_ GOOD CLIENTS ARE DEFINED
(unless a good-client match is more specific than a bad-client match)
if sender in good-clients list, "helo" welcomes a "friend"
if not rejected, then
local mail always delivered
if NORELAY relayed mail never delivered
if RELAY
mail not delivered if sender not in good-clients list,
i.e. it IS relayed if sender in good-clients list OR if
GOOD-CLIENTS LIST IS NOT DEFINED

Or, in more structured form:

IF good-clients list exists
THEN
IF sender not in bad-clients list or if there is no bad-clients list
THEN
IF sender in good-clients list THEN welcome "friend"
IF mail is local
THEN
accept mail
ELSE
IF relay is configured
THEN
IF sender in good-clients list
THEN
relay mail
ELSE
reject mail
ENDIF
ELSE
reject mail
ENDIF
ENDIF
ELSE
reject mail
ENDIF
ELSE
IF mail is local
THEN
accept mail regardless of whether bad-clients list exist and what is in it
ELSE
IF relay is configured
THEN
relay mail
ELSE
reject mail
ENDIF
ENDIF
ENDIF

This is the algorithm I would prefer:

reject if sender is in bad-clients list unless there is a more specific
match in an OPTIONAL good-clients list
if sender in good-clients list, "helo" welcomes a "friend"
if not rejected, then
local mail always delivered
if NORELAY relayed mail never delivered
if RELAY
relay only if sender is in good-clients list
it is NOT relayed if there is no good-clients list
if one wants to relay everything, put 0.0.0.0 in the good-clients list

In other words, to determine whether or not to reject the connection
right away, I would not require a good-clients list. It is necessary
only if a client needs to be specified more exactly which would
otherwise be rejected. On the other hand, if RELAY is turned on, then I
would require a good-clients list.

If RELAY is turned off, then I don't need a good-clients list unless I
need to specify a client more exactly which would otherwise be rejected.
With the current system, I need at least a good-clients list with a
dummy entry (e.g. private network which doesn't exist on the LAN). On
the other hand, if I want to have relay switched on, then I am forced to
specify the good clients.

Actually, there should be good-clients and bad-clients lists both for
reception and for relaying. It is conceivable that I would want to
accept email from a certain address, but would not want that address to
use my machine as a relay. With the current scheme, if I prevent an
address from relaying then, assuming relaying is allowed at all, I
can't receive any mail from that address.

.

Relevant Pages

  • RE: Sender Spoofing via SMTP
    ... Try adding a spf (sender privacy framework) entry in your DNS servers. ... definitely lock down the ability to be used as a relay. ... day to clear up the issue with all the blackhole lists. ...
    (Security-Basics)
  • Re: Bad-Clients: definitely not working
    ... the good client list can relay to the outside world. ... good clients list cannot relay to the outside world. ... to whom peoople in the world can send email to via your SMTP server ... The good clients need only specify hosts on your LAN. ...
    (comp.os.vms)
  • Groove 2007 users going offline and online and workspace issues
    ... Groove 2007 clients ... We have a Groove 2007 Relay and Manager set up. ... clients are connecting to the public relays and some are connecting to the ...
    (microsoft.public.office.misc)
  • Re: Bad-Clients: definitely not working
    ... the good client list can relay to the outside world. ... good clients list cannot relay to the outside world. ... to whom peoople in the world can send email to via your SMTP server ... send email to hosts that are not in your domain ...
    (comp.os.vms)
  • Re: Tightening E-Mail
    ... folder should usually be empty if no relay is taking place). ... You should also check your clients for infections of viruses that may ... relay based on the server config. ... > outbound versus the reports shown by my SPAM software (GFI ...
    (microsoft.public.windows.server.sbs)