Rejecting (554) a deleted alias on a host with catchall address

sd-sys

Hi there,

We have a host with a catchall address on a subdomain: @sub.domain.tld => user@domain.tld.

In addition, there are aliases routing mail to different mailboxes, e.g. alias1@sub.domain.tld => user2@domain.tld and alias2@sub.domain.tld => someone@externaldomain.tld. Some aliases have multiple recipients.

The user@domain.tld has the ability to edit aliases at @sub.domain.tld but cannot edit global filter maps.

Now comes the catch: the aliases change from time to time and need to be rejected (not nulled but 554′d) once they’ve fulfilled their purpose.

The easiest would be to remove the aliases and add the addresses to global_rcpt_blacklist.map in global filters (works and tested) but this is inconvenient since it requires admin interference with access to global filters.

We then thought to create a specific reject address rejectaddr@sub.domain.tld in global filters map and subsequently add aliases that need to be decommissioned as e g. alias1@sub.domain.tld => rejectaddr@sub.domain.tld. This however gets routed to the catchall for sub.domain.tld since global mail filter global_rcpt_blacklist.map is bypassed by the still existing and therefore valid alias.

So I guess the question is: does anyone have an idea how can we reject an existing alias address without removing the catchall and recurring to global filters?

System: running mailcow-dockerized 2022-09a

aaronsmith

I believe user settings override/take precedence over global settings. That’s likely why you’re seeing this happen. If the user has a valid alias configuration, their setting will be matched before the global one.

You can see an unrelated example of this with black/whitelists. Users can (for example) individually override a global blacklist entry by adding the domain to their whitelist:

https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-bl_wl/

sd-sys

Hi aaronsmith

Thanks for the reply !

That makes perfect sense but isn’t exactly related to our issue, i believe.

Our main problem is that when removing a previously active alias entry on a host that also has a catchall entry, there is no way to reject the mail at SMTP level unless an admin adds the former alias to the global filter recipient blacklist.

We’re trying to find a solution, where a non admin user could make that change e.g. setting the alias entry target to /dev/null or similar and therefore resulting in a REJECT from postfix.

Haven’t found a way to do that yet. For now we’ll gather discontinued aliases and an admin user later adds them to the global blacklist. Not ideal but works.

Thanks!