Merge pull request #441 from crazy-max/postfix-reverse-client-hostname-toggle

add Postfix reverse hostname rejection toggle

Author: crazy-max

README.md

@@ -158,6 +158,7 @@ linux/arm64
 * `POSTFIX_DEBUG`: Enable debug (default `false`)
 * `POSTFIX_MYNETWORKS`: Trusted SMTP clients that may relay outbound mail through Postfix (default `127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128`)
 * `POSTFIX_MESSAGE_SIZE_LIMIT`: The maximal size in bytes of a message, including envelope information (default `26214400`)
+* `POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME`: Reject clients when their IP address has no reverse DNS entry (default `true`)
 * `POSTFIX_STRIP_SENDER_HEADER`: Strip the Sender header from incoming emails to prevent SES rejection issues (default `false`)
 * `POSTFIX_SMTPD_TLS`: Enabling TLS in the Postfix SMTP server (default `false`, possible values: `true`|`may`|`encrypt`|`ask`|`require`, see [Postfix TLS README](https://www.postfix.org/TLS_README.html#client_tls_levels))
 * `POSTFIX_SMTPD_TLS_CERT_FILE`: File with the Postfix SMTP server RSA certificate in PEM format
@@ -182,6 +183,9 @@ linux/arm64
 > unless every client in those ranges is trusted to relay mail. Docker port
 > publishing and proxies can make external SMTP clients appear as private bridge
 > addresses.
+> If Docker or a proxy makes public SMTP clients appear as a local bridge address
+> without reverse DNS, set `POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME=false`
+> instead of trusting that bridge range.
 
 ### RSPAMD
 

rootfs/etc/cont-init.d/00-env

@@ -86,6 +86,7 @@ POSTFIX_DEBUG=${POSTFIX_DEBUG:-false}
 POSTFIX_LOG_PATH=/data/postfix/mail.log
 POSTFIX_MYNETWORKS="${POSTFIX_MYNETWORKS:-127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128}"
 POSTFIX_MESSAGE_SIZE_LIMIT=${POSTFIX_MESSAGE_SIZE_LIMIT:-26214400}
+POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME=${POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME:-true}
 POSTFIX_STRIP_SENDER_HEADER=${POSTFIX_STRIP_SENDER_HEADER:-false}
 POSTFIX_SMTPD_TLS=${POSTFIX_SMTPD_TLS:-false}
 POSTFIX_SMTP_TLS=${POSTFIX_SMTP_TLS:-false}

rootfs/etc/cont-init.d/15-config-postfix.sh

@@ -48,6 +48,12 @@ else
   ZEN_DOMAIN="${POSTFIX_SPAMHAUS_DQS_KEY}.zen.dq.spamhaus.net"
 fi
 
+POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME_RESTRICTION=""
+if [ "$POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME" = "true" ]; then
+  POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME_RESTRICTION=$',
+    reject_unknown_reverse_client_hostname'
+fi
+
 cat >>/etc/postfix/main.cf <<EOL
 myhostname = ${ANONADDY_HOSTNAME}
 mydomain = ${ANONADDY_DOMAIN}
@@ -90,8 +96,7 @@ smtpd_sender_restrictions =
     permit_mynetworks,
     permit_sasl_authenticated,
     reject_non_fqdn_sender,
-    reject_unknown_sender_domain,
-    reject_unknown_reverse_client_hostname
+    reject_unknown_sender_domain${POSTFIX_REJECT_UNKNOWN_REVERSE_CLIENT_HOSTNAME_RESTRICTION}
 
 smtpd_recipient_restrictions =
     permit_mynetworks,