Search

Wednesday, January 02, 2013

Prepare sendmail as MX and forward all incoming emails to another server

Our client has two sendmail boxes, one for receiving emails from
internet (ie as MX record), another one as the SMTP, POP3 and IMAP
server for internal users to send out emails and retrieve mail boxes.
By separating incoming and outgoing email traffic, he could reduce
impact of email bomb attack.

The followings apply to Sendmail 8.14.4.

1. First of all, in /etc/mailertable, we instruct sendmail to route
all incoming emails for our-domain.com.hk to another server.

our-domain.com.hk esmtp:[hostname-or-ip-of-another-server]

The [ ] will turn off MX lookup for this domain. Otherwise, there will
a MX loop.

After making changes, we have to rebuild the mailertable.db as below.

makemap hash mailertable.db < mailertable

2. Note that our sendmail.mc has to enable the 'mailertable' feature.

FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl

The sendmail.mc is a macro-based file for us to specify configuration
parameters easily. It has to be converted by the 'm4' utility to become
the ultimately required sendmail.cf.
m4 sendmail.mc > sendmail.cf
service sendmail restart


3. At the same time, we have to comment the DAEMON_OPTIONS such that
our sendmail will listen to internet smtp traffic.
dnl DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl


4. We have the option to reject emails if the sender domain is not
resolvable. Note that it might block some legitimate emails (eg users
on computers that do not have 7x24 DNS)

To turn it on/off, we use FEATURE(`accept_unresolvable_domains')dnl in
/etc/sendmail.mc

5. /etc/mail/local-host-names should be empty as incoming emails
should just be forwarded as said in mailertable.

6. Relaying is by default disabled in sendmail. We need to specify
the domains that we want to serve in the /etc/mail/access.

The example below permits emails sent to our-domain.com.hk and
specifically blacklist all emails coming spammer.com.

# By default we allow relaying from localhost...
Connect:localhost.localdomain RELAY
Connect:localhost RELAY
Connect:127.0.0.1 RELAY
To:our-domain.com.hk RELAY
From:spammer.com REJECT

After making changes to access, we have to rebuild it by:

makemap hash access.db < access

No comments:

Post a Comment