Postfix reject_unverified_recipient auto retry

postfixspam

We have an postfix SMTP server, used to relay mail for customers web scripts.
Postfix is using recipient address verification with reject_unverified_recipient in smtpd_recipient_restrictions (it is a must, due to high number of unwanted bounces otherwise):

smtpd_recipient_restrictions = 
    reject_unknown_recipient_domain
    reject_unverified_recipient
    permit_mynetworks
    reject_unauth_destination
    check_recipient_access hash:/etc/postfix/validrcptto

Problem is that first time some e-mail address is used, it will result in 450 4.1.1 <xxx@example.com>: Recipient address rejected: unverified address: Address verification in progress temporary errors, which client is supposed to retry later (as defined in section 4.5.4.1 of RFC 5321)

While the 4xx error is gone in few seconds (in vast majority of the cases, or replaced with 5xx permanent error), the customers web scripts (of course) try only once.

While it is relatively trivial to implement in web scripts (replace SEND_MAIL with while (count++ < 10) { SEND_MAIL; sleep(3) } pseudo-code), the number of different customers, third-party codebases with its auto upgrades etc) just explaining the problem over and over again is prohibitively resource-draining…

What I would like is something like reject_unverified_recipient_after_autoretry=30s which would not reply immediately to RCPT TO with 450 Address verification in progress but would instead block, waiting a few seconds in hope verify(8) will finish, and try again, and only return 450 if after (say) 30 seconds the code is still 450.

Note: accepting all mails from web scripts is not acceptable (even if sender is set to <> or some unattended/blackholed mailbox) – we really want address verification, and we want web apps to get 5xx errors if we can know the mail won't be able to reach recipient.

Best Answer

Found it eventually, the needed options (not mentioned in verify(8) manpage) are:

 address_verify_poll_count = ${stress?1}${stress:6}
 address_verify_poll_delay = 5s

This will wait on RCPT TO for address verification to finish for 6 iterations of 5 seconds (so up to 30 seconds) before returning 450 4.1.1 <xxx@example.com>: Recipient address rejected: unverified address: Address verification in progress error (Under high load it would try only once). Of course, if address verification finishes sooner, it will return sooner.

So exactly what I needed!

Options are available in Postfix 2.1 and later

Related Topic