[exim] Configuring unauthorised sender responses

[Merlin Hartley]

Greetings

We have been happily using exim on our mail servers for many years now but recently realised that some mail is being rejected due to response caching at our edge servers…

We use a simple list system (that I wrote a few years ago) which pulls data out of our HR database and creates files containing e-mail addresses (router described below) - which has an option to restrict the senders for submission to the list.
When a message is from an authorised sender it is delivered to the list - when the sender is not on the Allow list the message drops through to the next router and therefore ends up at the last router which has a ‘cannot_route_message’.

So far this sounds fine, the problem occurs when an intermediate MTA (e.g. our edge servers which I don’t control) tries to deliver a message with an unauthorised sender - this failure is then cached and no more messages to that list are accepted (even with authorised senders).

I expect I should be checking the senders in a different way and giving a different response code in cases where the sender is unauthorised - so that intermediate MTAs don’t cache the result for this recipient…

Does anyone have any pointers for me?

Thanks


Merlin



#### MBU Lists router ####
lists:
driver = redirect
# left 'domains' here in case we switch to a lists domain
domains = +local_domains
condition = ${if exists {MBU_lists_dir$local_part} {yes} {no} }
# this senders list checks for the 'allowed' file and if it does not exist allows any local sender
# e.g. /usr/lists/Allow.d/test-list
senders = ${if exists {MBU_lists_allowdir$local_part} {lsearch*@;MBU_lists_allowdir$local_part} {*@+local_domains} }
# e.g. /usr/lists/test-list
file = MBU_lists_dir$local_part
errors_to = MBU_postmaster
forbid_blackhole
forbid_file
forbid_include
forbid_pipe
one_time
retry_use_local_part
no_more


--
Merlin Hartley
Computer Officer
MRC Mitochondrial Biology Unit
Cambridge, CB2 0XY
United Kingdom

[Jeremy Harris]

Post by Merlin Hartley
We use a simple list system (that I wrote a few years ago) which pulls data out of our HR database and creates files containing e-mail addresses (router described below) - which has an option to restrict the senders for submission to the list.
When a message is from an authorised sender it is delivered to the list - when the sender is not on the Allow list the message drops through to the next router and therefore ends up at the last router which has a ‘cannot_route_message’.
So far this sounds fine, the problem occurs when an intermediate MTA (e.g. our edge servers which I don’t control) tries to deliver a message with an unauthorised sender - this failure is then cached and no more messages to that list are accepted (even with authorised senders).
I expect I should be checking the senders in a different way and giving a different response code in cases where the sender is unauthorised - so that intermediate MTAs don’t cache the result for this recipient…
Does anyone have any pointers for me?

I assume you're doing recipient verify, from the RCPT ACL - although the
router call is then checking the sender - so the intermediate MTA is
getting an SMTP-time rejection for the RCPT TO... which is your ML
submission address. As opposed to doing an accept-and-bounce.

Could you reject in the MAIL ACL instead?

[Merlin Hartley]

Thanks Jeremy

Sounds like ACL is likely to be the right place for this - but I have about a hundred lists some of which have an Allow file and it isn’t a separate domain to our mailboxes… seems complex…

Honestly I never really looked at ACLs I just use the defaults and write new routers when I want new functionality ;)

I probably have some reading ahead of me!


Merlin


--
Merlin Hartley
Computer Officer
MRC Mitochondrial Biology Unit
University of Cambridge
Cambridge, CB2 0XY
United Kingdom

Post by Jeremy Harris

Post by Merlin Hartley
We use a simple list system (that I wrote a few years ago) which pulls data out of our HR database and creates files containing e-mail addresses (router described below) - which has an option to restrict the senders for submission to the list.
When a message is from an authorised sender it is delivered to the list - when the sender is not on the Allow list the message drops through to the next router and therefore ends up at the last router which has a ‘cannot_route_message’.
So far this sounds fine, the problem occurs when an intermediate MTA (e.g. our edge servers which I don’t control) tries to deliver a message with an unauthorised sender - this failure is then cached and no more messages to that list are accepted (even with authorised senders).
I expect I should be checking the senders in a different way and giving a different response code in cases where the sender is unauthorised - so that intermediate MTAs don’t cache the result for this recipient…
Does anyone have any pointers for me?

I assume you're doing recipient verify, from the RCPT ACL - although the
router call is then checking the sender - so the intermediate MTA is
getting an SMTP-time rejection for the RCPT TO... which is your ML
submission address. As opposed to doing an accept-and-bounce.
Could you reject in the MAIL ACL instead?
--
Cheers,
Jeremy
--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

[Ian Zimmerman]

Post by Merlin Hartley
Honestly I never really looked at ACLs I just use the defaults and
write new routers

This seems to be a repeating pattern, maybe due to early Exim adopters
(when ACLs didn't exist). Maybe there ought to be a Big Fat warning
near the top of the documentation, to the effect "If you're just
starting to customize your Exim configuration, you shoud really study
ACLs first." Maybe even reorder the chapters.