Greetings,

Here's the situation:

- My smtp_hard_error_limit is set to 2

- A partner that needs to send mail to my domain is doing so via
pipelining

- That same partner is using distribution lists (DL's) to shotgun mail
to many people at my domain.

- There are invalid email addresses in the DL that the partner is
using.

- After two "user unknown" errors at the MTA level, the conversation is
terminated and the sending MTA gives up after a few tries.

So, some mail is failing to make it through because of the failure of
my partner to groom the DL's or to use DL's that are populated from a
directory server (LDAP or somesuch that would only show currently valid
addresses...hopefully).

My question is this: Will adding the netblock that my partner's MTA's
are in to _mynetworks_ somehow bypass the error limit noted above?

I realize that mynetworks is supposed to be used for allowing relaying,
and in a sense that's what's happening here since we do trust the
sending MTA's.

I'll be happy to clarify if there are any points that I didn't make
sufficiently clear.

Cheers,

Patrick

setuidzero@gmail.com wrote:
> Greetings,
>
> Here's the situation:
>
> - My smtp_hard_error_limit is set to 2
>
> - A partner that needs to send mail to my domain is doing so via
> pipelining
>
> - That same partner is using distribution lists (DL's) to shotgun mail
> to many people at my domain.
>
> - There are invalid email addresses in the DL that the partner is
> using.
>
> - After two "user unknown" errors at the MTA level, the conversation is
> terminated and the sending MTA gives up after a few tries.
>
> So, some mail is failing to make it through because of the failure of
> my partner to groom the DL's or to use DL's that are populated from a
> directory server (LDAP or somesuch that would only show currently valid
> addresses...hopefully).
>
> My question is this: Will adding the netblock that my partner's MTA's
> are in to _mynetworks_ somehow bypass the error limit noted above?
>
> I realize that mynetworks is supposed to be used for allowing relaying,
> and in a sense that's what's happening here since we do trust the
> sending MTA's.
>
> I'll be happy to clarify if there are any points that I didn't make
> sufficiently clear.
>
> Cheers,
>
> Patrick
>

Nope, don't think so. Also see:
http://groups.google.com/group/list....56efdcbe17cd7f

Besides increasing the value, a couple of (painful) alternatives I can think of are:

1. Modify master.cf to have a smtpd session listening on another port besides 25, with the values raised,
and only that site has access.

2. Add a 2nd IP address alias to your system, and run another instance of Postfix, just for that site.


Both are ugly, and would require cooperation from the sending site administrator. Sounds like there
is not much cooperation there now, if they keep on sending to bounced unknown email addresses...

--
Greg

Greg Hackney wrote:

>
> Nope, don't think so. Also see:
> http://groups.google.com/group/list....56efdcbe17cd7f
>
> Besides increasing the value, a couple of (painful) alternatives I can think of are:
>
> 1. Modify master.cf to have a smtpd session listening on another port besides 25, with the values raised,
> and only that site has access.
>
> 2. Add a 2nd IP address alias to your system, and run another instance of Postfix, just for that site.
>
>
> Both are ugly, and would require cooperation from the sending site administrator. Sounds like there
> is not much cooperation there now, if they keep on sending to bounced unknown email addresses...
>

Thanks for the reply

Both of those solutions are pretty ugly and are definitely not in the
spirit of what we should be doing here. I'll see what I can do to
twist some arms on the far end.

Thanks again,

Patrick