completed the relaying page

This commit is contained in:
Christoph Haas 2025-09-04 22:00:50 +02:00
parent 4bc8c0c546
commit f5a6a57ce6

View file

@ -338,12 +338,14 @@ As a result you will get the exact same string you used above with "AUTH PLAIN".
Please note that there are two different TCP ports on a mail server that speak SMTP:
| Service name | SMTP | Submission | Submission TLS |
| Service name | SMTP | Submission | Submissions |
| -------------------- | ------------------------------------ | ---------------------------- | --------------------- |
| TCP Port | 25 | 587 | 465 |
| Transport encryption | **Off** at first. STARTTLS optional. | **Off**. STARTTLS mandatory. | TLS all the time |
| Authentication | Optional [^1] | Mandatory | Mandatory |
| Meant for | Servers | Humans | Humans |
| Accepted sender | Anyone | Our own users | Our own users |
| Accepted receivers | Our own users | Anyone | Anyone |
| Meant for | Servers | Our users | Our users |
| Used by | Mail transport agent (MTA) | Mail user agent (MUA) | Mail user agent (MUA) |
| Your home ISP | may block this port | will allow this port | will allow this port |
@ -354,8 +356,10 @@ Please note that there are two different TCP ports on a mail server that speak S
required this setting to be `on` would be if your server were a relay (_smarthost_) for other servers using
authentication..
I hope that makes the distinction a bit clearer. Our human users will have to use the _submission_ service either on 587
or 465.
I hope this helps clarify the distinction. Human users must use the submission service on either port 587 or 465. The
key difference is that connections on port 587 start unencrypted, and the email client must issue the STARTTLS command
to enable encryption. In contrast, port 465 requires the email client to use TLS encryption right from the first byte of
communication.
## Configure the submission service
@ -529,21 +533,18 @@ The server should rightfully reject that wrong sender:
<~ * 553 5.7.1 john@example.com: Sender address rejected: not owned by user john@example.org
```
---
Of course you can test your new security feature in the Roundcube web mail interface as well. In Settings/Identities you
can create another sender email address as in:
You can also see that restriction in action by adding a fake persona in Roundcube and try to use it. In
Settings/Identities you can create another sender email address as in:
![Selecting another identity in Roundcube](images/relaying-roundcube-selecting-identity.png)
With this wrong sender address any email should get rejected. Your mail.log would read something like:
With this wrong sender address any email should get rejected. Roundcube will show you an error that is generated by
Postfix:
```
NOQUEUE: reject: RCPT from foo.bar\[…\]:
553 5.7.1 <someoneelse@example.com>:
Sender address rejected:
not owned by user john@example.org;
from=<someoneelse@example.com> to=<…>
not owned by user john@example.org
```
<Aside type="tip" title="Allow aliases?">