Postfix development server – intercept all outgoing mail

postfix

So a few times now I've been caught out by clients receiving mail sent from the development server because I didn't sanitize the db. So, as an extra safe option, I'd like to ensure that all mail sent from my dev machine is either rejected based on domain or forwarded to myself.

I found a few questions that do a little of what I require;

Postfix on development server, allow mail to be sent to only one domain – This looks good and is what I have implemented so far, but the comment on the first answer is correct. Mail sent through Sendmail does not seem to use this setting.

postfix: catch outgoing mail and redirect – THis looked ok, but updating the transport did not do squat for me.

I also looked at address rewriting http://www.postfix.org/ADDRESS_REWRITING_README.html and read this blog post http://rene.bz/redirect-all-outgoing-email-single-account-postfix/

I am testing this by calling sendmail on the command line with the -t param like so;

sendmail -t < mail

where the contents of 'mail' are

Date: Tue Oct 11 11:25:22 2011 
To: c@example.com 
Subject: test 
From: whatever@somewhere.com
test

I have been changing the address to be my gmail address and the example.com address. I'm wanting all mail to go to another (work) domain.

So far, I have seen no restrictions come into effect.

/etc/postfix/transport looks like this;

example.com :
.example.com :
* :discard

I have added these lines to main.cf

smtpd_recipient_restrictions = hash:/etc/postfix/my_access, reject
transport_maps = hash:/etc/postfix/transport

Please also note I am using the Postfix bundled with MAMP and have been editing main.cf through MAMP – File > Edit Template > main.cf

Best Answer

You should install pcre and create a virtual alias file:

apt-get install postfix-pcre

in mail.cf:

virtual_alias_maps = pcre:/etc/postfix/virtual

In /etc/postfix/virtual:

/.*@.*/  $user

Replace $user with the useraccount of your catchall mailbox. Now every single mail sent from that server will be caught in the catchall mailbox

Related Solutions

Postfix – DKIM Sign Outgoing Mail from Any Domain

Ok I managed to figure this out on my own, but I wanted to post the steps here for posterity because there was zero documentation on this (that I could find) and it was practically guess and check.

After I set "Domain *" as described above, it would sign it like this:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=clientdomain.com;
    s=main; t=1250005729;
    bh=twleuNpYDuUTZQ/ur9Y2wxCprI0RpF4+LlFYMG81xwE=;
    h=Date:From:To:Message-Id:Subject:Mime-Version:Content-Type;
    b=kohI7XnLlw/uG4XMJoloc4m9zC13g48+Av5w5z7CVE0u3NxsfEqwfDriapn7s7Upi
     31F3k8PDT+eF57gOu2riXaOi53bH3Fn/+j0xCgJf8QpRVfk397w4nUWP/y8tz4jfRx
     GhH21iYo05umP0XflHNglpyEX02bssscu2VzXwMc=

notice the "d=clientdomain.com". It was generating this based on the from address in the email, where the from address was something like "contact@clientdomain.com". Obviously if it checked the client's domain and not mine no DNS TXT record was there and the verification would fail.

So anyway I found out in this documentaion that you can set a KeyList parameter. http://manpages.ubuntu.com/manpages/hardy/man5/dkim-filter.conf.5.html

It didn't really describe what I wanted to do, but I figured I'd play with it. I commented out KeyFile and set KeyList to "/etc/mail/dkim_domains.key" which is an arbitrary file name I made up. I then created that file and put this in it "*:feedmailpro.com:/etc/mail/dkim.key". This tells it for any client domain, sign it with my domain (feedmailpro.com), and use the dkim.key file.

Restarted DKIM and postfix

sudo /etc/init.d/dkim-filter restart
sudo /etc/init.d/postfix restart

Now this is the key it generated when I sent a test email.

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=feedmailpro.com;
    s=dkim.key; t=1250005729;
    bh=twleuNpYDuUTZQ/ur9Y2wxCprI0RpF4+LlFYMG81xwE=;
    h=Date:From:To:Message-Id:Subject:Mime-Version:Content-Type;
    b=kohI7XnLlw/uG4XMJoloc4m9zC13g48+Av5w5z7CVE0u3NxsfEqwfDriapn7s7Upi
     31F3k8PDT+eF57gOu2riXaOi53bH3Fn/+j0xCgJf8QpRVfk397w4nUWP/y8tz4jfRx
     GhH21iYo05umP0XflHNglpyEX02bssscu2VzXwMc=

Improvement, you see the d= now is set to my domain (even though the from address of the email was not my domain). However s= got changed to "dkim.key" instead of the selector I chose in dkim-filter.conf. In the original setup instructions I'd set the selector to "mail". That was weird, but I noticed it changed it to the filename of my key, dkim.key.

So I went and renamed "/etc/mail/dkim.key" to "/etc/mail/mail". Also updated the reference to it in "/etc/mail/dkim_domains.key".

Restart dkim-filter and postfix again same as above, and now it started working. Here is the final header which signs correctly using the right selector (apparently based off the filename of the key).

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=feedmailpro.com;
    s=mail; t=1250006218;
    bh=tBguOuDhBDlhv0m4KF66LG10V/8ijLcAKZ4JbjpLXFM=;
    h=Date:From:To:Message-Id:Subject:Mime-Version:Content-Type;
    b=c9eqvd+CY86BJDUItWVVRvI3nibfEDORZbye+sD1PVltrcSBOiLZAxF3Y/4mP6vRX
     MUUNCC004oIH1u7FYafgF32lpuioMP1cd7bi6x3AZ5zH4BYETNBnnz4AhAPBtqlIh/
     FFMz8jkhhLhcM2hDpwJkuKjAe3LzfNVDP8kD11ZI=

Now s=mail is right, and d=feedmailpro.com is right. It works!

Overall this was way harder than I expected and there seemed to be zero documentation on how to do this (signing for all outgoing domains), but I guess it's open source software so I can't complain.

One final note, to check if the TXT DNS record was setup correctly you can do a command like with your domain

dig mail._domainkey.feedmailpro.com TXT

May need to install dig (sudo apt-get install dig). If you're using Slicehost manager to add the DNS entry, you'd enter the TXT record like this.

Type: TXT
Name: mail._domainkey
Data: k=rsa; t=s; p=M5GfMA0...YOUR LONG KEY...fIDAQAB
TTL seconds: 86400

I don't really understand why the name is set to "mail._domainkey" without a period on the end or without my domain, like "mail._domainkey.feedmailpro.com". But whatever, it seems to work so I'm happy.

If you're trying to duplicate this, here are the instructions I started with: https://help.ubuntu.com/community/Postfix/DKIM

Postfix, canonical_classes, and cron mail

Might check these two: remote_header_rewrite_domain and local_header_rewrite_clients

The latter defaults to "permit_inet_interfaces" which, in the description of this other parameter, might give you the answer?

always_add_missing_headers (default: no):
   Always add (Resent-) From:, To:, Date: or Message-ID: headers when not
   present.  Postfix 2.6 and later add these headers only when clients
   match the local_header_rewrite_clients parameter setting.  Earlier
   Postfix versions always add these headers; this may break DKIM
   signatures that cover non-existent headers.**

Even though the default is no, perhaps the local_header_rewrite_clients parameter not being empty is causing this.

However, I might also add the following (from the man page):

The canonical(5) mapping is not to be confused with virtual alias
support or with local aliasing. To change the destination but not the
headers, use the virtual(5) or aliases(5) map instead.**

While what you're doing should work, perhaps using virtual/aliases would work better?

Oh, also just found that there are sender_canonical_classes and recipient_canonical_classes parameters as well. May want to check on those.

Best Answer

Related Solutions

Postfix – DKIM Sign Outgoing Mail from Any Domain

Postfix, canonical_classes, and cron mail

Related Topic