Today, in an attempt to reduce the amount of spam that gets received by my mail server, which runs Postfix, I implemented greylisting, courtesy of postgrey. I can’t disagree with those who say that greylisting misuses other’s bandwidth (for the unnecessary retries of legitimate mail), but perhaps that’s a small price to pay.
Another change I made today was to enable certificate-based relaying. It’s the perfect answer for those who need to relay mail for users with dynamic IPs in scenarios where a password-based solution isn’t ideal (for example, when the relay needs to authenticate another MTA rather than a user). There are quite a few guides describing how to setup certificate based relaying, but Petri T. Koistinen’s one is one of the better ones. Small tip – make sure to use the correct CA certificate (the one actually used to sign the client certificate), otherwise relaying won’t work and postfix will spit out errors like the following:
postfix/smtpd[32477]: verify error:num=20:unable to get local issuer certificate
postfix/smtpd[32477]: verify error:num=27:certificate not trusted
postfix/smtpd[32477]: verify error:num=21:unable to verify the first certificate
Recent Comments