Postfix configuraton, writed after postfix admin book.
master.cf:
strict_rfc821_envelopes = yes
strict_mime_encoding_domain = no
disable_vrfy_command = yes
smtpd_helo_required = yes
smtpd_banner = $myhostname
smtpd_error_sleep_time = 1s
smtpd_soft_error_limit = 5
smtpd_hard_error_limit = 10
smtpd_recipient_restrictions =
reject_non_fqdn_sender
reject_non_fqdn_recipient
reject_unknown_sender_domain
reject_unknown_recipient_domain
permit_mynetworks
permit_sasl_authenticated
reject_unauth_destination
reject_non_fqdn_helo_hostname
reject_invalid_helo_hostname
check_helo_access pcre:/etc/postfix/helo_checks
check_sender_mx_access cidr:/etc/postfix/bogus_mx
reject_unknown_helo_hostname
reject_rbl_client bl.spamcop.net
reject_rbl_client sbl.spamhaus.org=127.0.0.2
reject_rbl_client cbl.abuseat.org=127.0.0.2
reject_rbl_client dnsbl.sorbs.net
reject_rbl_client dnsbl.njabl.org
check_policy_service inet:127.0.0.1:60000
permit
smtpd_data_restrictions =
reject_multi_recipient_bounce
smtpd_client_restrictions =
permit_mynetworks
check_client_access hash:/etc/postfix/sender_checks
permit
content_filter = smtp-amavis:[127.0.0.1]:10024
receive_override_options = no_address_mappings
helo_checks:
/^ns2\.parmatel\.ru$/ 550 Don't use my hostname!
/^mail\.parmatel\.ru$/ 550 Don't use my hostname!
/^194\.8\.68\.3$/ 550 Don't use my IP-address!
/^\[194\.8\.68\.3\]$/ 550 Don't use my IP-address!
/^[0-9.]+$/ 550 Use hostname, not IP address!
/^CO-VRT-021\.elfnet\.local$/ OK
/^preved\.aup\.komienergo\.ru$/ OK
/^srv-sbs\.evrokniga\.ru$/ OK
несколько океев - чтобы принимать почту с криво настроенных почтовиков -
обратная зона у которых указывает на адрес, разресолвить который не удается
bogus_mx: тут всё стандартно
#bogus networks
0.0.0.0/8 550 Mail server in broadcast network!
10.0.0.0/8 550 RFC1918 private network, no route!
172.16.0.0/12 550 RFC1918 private network, no route!
192.168.0.0/16 550 RFC1918 private network, no route!
127.0.0.0/8 550 Mail server in loopback network!
sender_checks:
89.111.164: 401 Network 89.11.164 rejected!
когда-то вылезла спамерская подсетка - закрыл всю.