completed the relaying page
This commit is contained in:
parent
4bc8c0c546
commit
f5a6a57ce6
1 changed files with 15 additions and 14 deletions
|
|
@ -338,12 +338,14 @@ As a result you will get the exact same string you used above with "AUTH PLAIN".
|
|||
|
||||
Please note that there are two different TCP ports on a mail server that speak SMTP:
|
||||
|
||||
| Service name | SMTP | Submission | Submission TLS |
|
||||
| Service name | SMTP | Submission | Submissions |
|
||||
| -------------------- | ------------------------------------ | ---------------------------- | --------------------- |
|
||||
| TCP Port | 25 | 587 | 465 |
|
||||
| Transport encryption | **Off** at first. STARTTLS optional. | **Off**. STARTTLS mandatory. | TLS all the time |
|
||||
| Authentication | Optional [^1] | Mandatory | Mandatory |
|
||||
| Meant for | Servers | Humans | Humans |
|
||||
| Accepted sender | Anyone | Our own users | Our own users |
|
||||
| Accepted receivers | Our own users | Anyone | Anyone |
|
||||
| Meant for | Servers | Our users | Our users |
|
||||
| Used by | Mail transport agent (MTA) | Mail user agent (MUA) | Mail user agent (MUA) |
|
||||
| Your home ISP | may block this port | will allow this port | will allow this port |
|
||||
|
||||
|
|
@ -354,8 +356,10 @@ Please note that there are two different TCP ports on a mail server that speak S
|
|||
required this setting to be `on` would be if your server were a relay (_smarthost_) for other servers using
|
||||
authentication..
|
||||
|
||||
I hope that makes the distinction a bit clearer. Our human users will have to use the _submission_ service either on 587
|
||||
or 465.
|
||||
I hope this helps clarify the distinction. Human users must use the submission service on either port 587 or 465. The
|
||||
key difference is that connections on port 587 start unencrypted, and the email client must issue the STARTTLS command
|
||||
to enable encryption. In contrast, port 465 requires the email client to use TLS encryption right from the first byte of
|
||||
communication.
|
||||
|
||||
## Configure the submission service
|
||||
|
||||
|
|
@ -529,21 +533,18 @@ The server should rightfully reject that wrong sender:
|
|||
<~ * 553 5.7.1 john@example.com: Sender address rejected: not owned by user john@example.org
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
Of course you can test your new security feature in the Roundcube web mail interface as well. In Settings/Identities you
|
||||
can create another sender email address as in:
|
||||
You can also see that restriction in action by adding a fake persona in Roundcube and try to use it. In
|
||||
Settings/Identities you can create another sender email address as in:
|
||||
|
||||

|
||||
|
||||
With this wrong sender address any email should get rejected. Your mail.log would read something like:
|
||||
With this wrong sender address any email should get rejected. Roundcube will show you an error that is generated by
|
||||
Postfix:
|
||||
|
||||
```
|
||||
NOQUEUE: reject: RCPT from foo.bar\[…\]:
|
||||
553 5.7.1 <someoneelse@example.com>:
|
||||
Sender address rejected:
|
||||
not owned by user john@example.org;
|
||||
from=<someoneelse@example.com> to=<…>
|
||||
553 5.7.1 <someoneelse@example.com>:
|
||||
Sender address rejected:
|
||||
not owned by user john@example.org
|
||||
```
|
||||
|
||||
<Aside type="tip" title="Allow aliases?">
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue