smtpd_recipient_restrictions works but not always

Question

I have POSTFIX set up to filter certain email addresses. The main.cf file contains:

smtpd_recipient_restrictions =
    check_recipient_access hash:/etc/postfix/blacklist,
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    permit

When I try to send an email to one of the addresses on the blacklist, I get the error 554 5.7.1 Access denied. just as it should be. Also when I try to send with telnet the message gets blocked. However, this server has a mailing software installed which is php based and uses swiftmailer to send messages. When I try to send a message using this software, any message to one of the blocked addresses goes through.

What could be the reason for that? How can I trace it down and debug this?

Does the message go through postfix or does the php mailer send messages directly bypassing your postfix? — Dan, Feb 13 '15 at 20:57
@Dan I would not know how PHP could send the message directly without going via the Postfix SMTP. What I can tell you is that the mailing software is set up to use the default server sending method, and the mail sent from that software shows in `/var/log/maillog` — Kolja, Feb 13 '15 at 21:01
Default method usually means invoking mail or sendmail binary directly, not talking smtp to local mailer daemon. If possible, set your php mailer to use smtp and set localhost as smtp server name — Dan, Feb 13 '15 at 21:03

score 4 · Accepted Answer · answered Feb 14 '15 at 07:27

There are two methods of sending mail if the local machine runs a smtp server.

You can use the smtp protocol (just like any other remote client), connect to localhost port 25 and do the whole smtp talk. In this case smtpd client restrictions do apply.

Or you just run the sendmail binary with appropiate arguments. In this case you do not use the smtp protocol, hence the restrictions are not enforced.

For example the php mail() function on linux will use the second method, using as default sendmail -t -i command, or whatever is configured in php.ini as sendmail_path

Swiftmailer supports both methods, so you can change the code to use smtp instead of sendmail. See here http://swiftmailer.org/docs/sending.html

score 0 · Answer 2 · answered Jan 29 '19 at 23:42

If you would add -v into commands, eg. smtpd, in /etc/postfix/master.cf and postfix reload, you would see plenty of details how postfix checks your incoming mail.

Anyway, smtpd_recipient_restrictions does generally checks on RCPT TO command. And as your PHP app passes your smtpd_recipient_restrictions, thus it must go via pickup (sendmail-like command) and not via SMTP.

IMO giving mail() function to PHP is asking for trouble. I would recommend you to disable it (there are multiple ways...):

# env -i php-7.0 -r 'echo function_exists("mail") ? "yes\n" : "no\n";' 
no

Also filtering on pickup is more complicated.

I also doubt the topic is clear. It seems to me that you are trying to restrict sending of PHP app itself, so it should be probably better to use other restrictions, eg. HELO, sender or AUTH via submission port.

smtpd_recipient_restrictions works but not always

2 Answers2