sendmail ignoring response from mailer?

[Piotr Lechowicz]

Hello everybody

I configured sendmail with virtual users and dovecot lda as delivering mailer (dovecot runs with MySQL as user and password backends).

It generally works, but i have problem with incoming messages addressed to non-existent users.
Sendmail accepts such a kind of mails and sends back reply with "5.1.1 User unknown" dsn message.

I would prefer to reject messages to unknown users directly in smtp session.
I need someone point me how debug my configuration more deeply to find source of problem.
Or maybe suggestion about another approach to routing incoming mails to dovecot mailer to avoid the problem.

Logs and configs attached below.

Regards

Piotr




Incoming messages are routed to dovecot mailer via mailertable entry:

example.net dovecot:dovecot

and mailer configuration is:

######################*****##############
### DOVECOT Mailer specification ###
##################*****##################
Mdovecot, P=/usr/libexec/dovecot/dovecot-lda,
F=l59DFMPhnu,
S=EnvFromL/HdrFromL, R=EnvToL/HdrToL,
M=51200000,
U=vmail:vmail,
T=DNS/RFC822/X-Unix,
A=/usr/libexec/dovecot/dovecot-lda -d $u



SMPT session from server side (maillog):

> Mar 26 15:50:26 mymx sendmail[9335]: v2QDnXo6009335: from=valid...@example.com, size=18, class=0, nrcpts=1, msgid=<201703261350....@mymx.example.net>, proto=SMTP, daemon=MTA, relay=somewhere-in-space.tld [10.0.0.1]
> Mar 26 15:50:26 mymx dovecot: auth: mysql: Connected to /var/lib/mysql/mysql.sock (database)
> Mar 26 15:50:26 mymx dovecot: auth: sql(nonexistent.user): unknown user
> Mar 26 15:50:26 mymx sendmail[9393]: v2QDnXo6009335: to=nonexist...@example.net, delay=00:00:16, xdelay=00:00:00, mailer=dovecot, pri=120018, relay=dovecot, dsn=5.1.1, stat=User unknown
> Mar 26 15:50:26 mymx sendmail[9393]: v2QDnXo6009335: v2QDoQo6009393: DSN: User unknown
> Mar 26 15:50:27 mymx sendmail[9393]: v2QDoQo6009393: to=valid...@example.com, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, pri=31465, relay=[192.168.0.1] [192.168.0.1], dsn=2.0.0, stat=Sent (v2QDoQSA023944 Message accepted for delivery)


SMTP session from client side:

> 220 mymx.example.net ESMTP mail service
> helo tester
> 250 mymx.example.net Hello somewhere-in-space.tld [10.0.0.1], pleased to meet you
> mail from:valid...@example.com
> 250 2.1.0 valid...@example.com... Sender ok
> rcpt to:nonexist...@example.net
> 250 2.1.5 nonexist...@example.net... Recipient ok
> data
> 354 Enter mail, end with "." on a line by itself
> Subject: test 1
> 1
> .
> 250 2.0.0 v2QDnXo6009335 Message accepted for delivery
>


And DSN message received by original sender:

> The original message was received at Sun, 26 Mar 2017 15:50:10 +0200
> from somewhere-in-space.tld [10.0.0.1]
>
> ----- The following addresses had permanent fatal errors -----
> nonexist...@example.net
> (reason: User unknown)
>
> ----- Transcript of session follows -----
> 550 5.1.1 nonexist...@example.net... User unknown

[Claus Aßmann]

Piotr Lechowicz wrote:

> It generally works, but i have problem with incoming messages addressed to non-existent users.
> Sendmail accepts such a kind of mails and sends back reply with "5.1.1 User unknown" dsn message.

> I would prefer to reject messages to unknown users directly in smtp session.

Then you need to provide a rule to detect unknown users during the
SMTP session. Local_check_rcpt would be a good place to start, see
cf/README and doc/op/op.*

Your mailer is run after the mail has been accepted, not synchronously
(which would be a disaster for multi-RCPT mails) -- it's "store and
forward".

> Or maybe suggestion about another approach to routing incoming mails to dovecot mailer to
> avoid the problem.

Seems you have a misconception how SMTP (sendmail and other MTAs) works.

> > 250 mymx.example.net Hello somewhere-in-space.tld [10.0.0.1], pleased to meet you
> > mail from:valid...@example.com

And here's another error... see the fine RFCs for the correct syntax.

MAIL From:<valid...@example.com>

> > rcpt to:nonexist...@example.net

Same here.


So sendmail is NOT "ignoring response from mailer",
after all you get a DSN.

--
Note: please read the netiquette before posting. I will almost never
reply to top-postings which include a full copy of the previous
article(s) at the end because it's annoying, shows that the poster
is too lazy to trim his article, and it's wasting the time of all readers.

[Andrzej Adam Filip]

Piotr Lechowicz <edit...@gmail.com> wrote:
> I configured sendmail with virtual users and dovecot lda as delivering
> mailer (dovecot runs with MySQL as user and password backends).
>
> It generally works, but i have problem with incoming messages
> addressed to non-existent users.
> Sendmail accepts such a kind of mails and sends back reply with "5.1.1
> User unknown" dsn message.
>
> I would prefer to reject messages to unknown users directly in smtp
> session.
> I need someone point me how debug my configuration more deeply to find
> source of problem.
> Or maybe suggestion about another approach to routing incoming mails
> to dovecot mailer to avoid the problem.
>
> Logs and configs attached below.

> [...]

> Incoming messages are routed to dovecot mailer via mailertable entry:
>
> example.net dovecot:dovecot

> [...]

You may choose one of the following obvious paths:
a) periodically dump MySQL list of valid addresses in example.net into
virtusertable with "reject remaining example.net addresses" entry
[virtusertable can work for non local email domains]
b) use milter for rejecting invalid addresses in example.net domain
e.g. perl based MIMEDefang for standard anti-spam and anti-virus
checks plus extra recipient checks in MySQL datanase
[ It may be a good option if you use MIMEDefang anyway ]
c) use MTA/SMTP server with MySQL support e.g. postfix (exim?)
http://www.postfix.org/MYSQL_README.html
AFAIR postfix will also simplify implementation of SMTP AUTH based on
dovecot's passwords.

Of course the list is not complete especially for some "special cases"
[ e.g. separate OS account for every dovecot mailbox ]

--
[Andrew] Andrzej A. Filip - https://www.linkedin.com/in/andfil