Wednesday, January 02, 2013

Prepare sendmail as MX and forward all incoming emails to another server

Our client has two sendmail boxes, one for receiving emails from
internet (ie as MX record), another one as the SMTP, POP3 and IMAP
server for internal users to send out emails and retrieve mail boxes.
By separating incoming and outgoing email traffic, he could reduce
impact of email bomb attack.

The followings apply to Sendmail 8.14.4.

1. First of all, in /etc/mailertable, we instruct sendmail to route
all incoming emails for to another server. esmtp:[hostname-or-ip-of-another-server]

The [ ] will turn off MX lookup for this domain. Otherwise, there will
a MX loop.

After making changes, we have to rebuild the mailertable.db as below.

makemap hash mailertable.db < mailertable

2. Note that our has to enable the 'mailertable' feature.

FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl

The is a macro-based file for us to specify configuration
parameters easily. It has to be converted by the 'm4' utility to become
the ultimately required
m4 >
service sendmail restart

3. At the same time, we have to comment the DAEMON_OPTIONS such that
our sendmail will listen to internet smtp traffic.
dnl DAEMON_OPTIONS(`Port=smtp,Addr=, Name=MTA')dnl

4. We have the option to reject emails if the sender domain is not
resolvable. Note that it might block some legitimate emails (eg users
on computers that do not have 7x24 DNS)

To turn it on/off, we use FEATURE(`accept_unresolvable_domains')dnl in

5. /etc/mail/local-host-names should be empty as incoming emails
should just be forwarded as said in mailertable.

6. Relaying is by default disabled in sendmail. We need to specify
the domains that we want to serve in the /etc/mail/access.

The example below permits emails sent to and
specifically blacklist all emails coming

# By default we allow relaying from localhost...
Connect:localhost.localdomain RELAY
Connect:localhost RELAY

After making changes to access, we have to rebuild it by:

makemap hash access.db < access

No comments:

Post a Comment