search

roehling / postsrsd

Postfix Sender Rewriting Scheme daemon
326 stars 39 forks source link

Endless loop #140

Open nd1012 opened 1 year ago

nd1012 commented 1 year ago

Hi,

I'm using postsrsd since some years now on several MTAs, but today I had a strange behavior (the daemon is configured as documented btw.). This is how an incoming email is being processed:

  1. MX is an antispam system, which forwards to the SRS MTA (the antispam system is whitelisted here)
  2. The SRS MTA is responsible for email delivery and sends all outgoing email using the antispam system as SMTP relay

Today a spam email found its way trough the antispam system, targeting a non-existing alias of the used SRS domain (which should bounce, actually). Now this happened:

  1. Antispam system forwarded email from alias@spammer.tld to the SRS MTA
  2. SRS MTA rewrote the sender address to SRS...spammer.tld=alias@srsdomain.tld and sends it using the antispam system as SMTP relay to its own SRS domain MX (!?)
  3. Antispam system forwarded the email using the SRS rewritten sender back to the SRS MTA
  4. SRS MTA is happy about the valid SRS sender and doesn't rewrite again, but still sends it using the antispam system as SMTP relay to its own SRS domain again (!?)

Then this loops endless from point 3. Usually I assumed if the recipient email alias wasn't found at the SRS MTA, the email should be bounced here (this is how it is configured and it works with non-SRS domains). But instead the sender is being rewritten, if required, and the email is being sent again - so Postfix stops the processing at that point, and there is no local recipient alias validation using the virtual maps anymore.

Now I try to find a way to fix that problem... Do you have any idea what could be wrong, why that nasty loop happens?

roehling commented 1 year ago

Off the top of my head, the fact that the SRS MTA treats srsdomain.tld as a relay domain looks fishy. If I understand your setup correctly, one of two things should happen for any mail addressed to that domain:

  1. The recipient is a valid SRS alias, PostSRSd rewrites it to the actual destination, and the SRS MTA relays it to your antispam system.
  2. The recipient is not a valid SRS alias, PostSRSd will not touch it, and the SRS MTA should either deliver it locally (if it is addressed to a valid local mailbox) or reject it.

What definitely should not happen is that the SRS MTA relays emails for srsdomain.tld which it cannot deliver locally.

roehling commented 1 year ago

Did you solve the issue? If yes, I'm curious to know what the problem was.