Re: forward DNS lookups in $mynetworks or check_client_access

[/dev/rob0 <rob0@xxxxxxxxx>]

On Monday 04 October 2004 03:06, Magnus Bäck wrote:
> I hope you're not setting up a dynamic DNS service for relaying
> purposes only.

I set up DDNS quite some time ago, for DDNS purposes. :)

> > But my experimentation (hash lookup and direct file inclusion)
> > indicates that only the IP and the reverse DNS name is checked
> > against $mynetworks.
> >
> > Is the same true of check_client_access?
>
> No. Read access(5).

What, then, am I missing? I have read access(5) and I just tried adding 
"check_client_access hash:/etc/postfix/relay_hosts" right after the 
"permit_mynetworks" in smtpd_recipient_restrictions. That file contains 
this line:
    ark.1984.lan	OK
and in my internal DNS that resolves:
    $ host ark
    ark.1984.lan has address x.x.224.226
(a real IP, not in $mynetworks.) After "postfix reload" I went to that 
machine and telnet'ed:
...
mail from: <rob0@xxxxxxxxxxxxxxxxxxx>
250 Ok
rcpt to: rob@xxxxxxxxx
554 <rob@xxxxxxxxx>: Relay access denied
...
Logged:
Oct  4 07:19:36 please postfix/smtpd[19056]: NOQUEUE: reject: RCPT from
    x-x-224-226.rdns[x.x.224.226]: 554 <rob@xxxxxxxxx>: Relay access
    denied; from=<rob@xxxxxxxxxxxxxxxxxxx> to=<rob@xxxxxxxxx>
    proto=SMTP helo=<ark>

ISTM that only the ISP's reverse DNS was checked against the access 
table. Adding THAT string to my access table, "postmap relay_hosts", 
and trying again, it worked.

access(5):
...
DESCRIPTION
       The  optional access table directs the Postfix SMTP server
       to selectively  reject  or  accept  mail.  Access  can  be
       allowed  or  denied for specific host names, domain names,
       networks, host network addresses or mail addresses.
...
HOST NAME/ADDRESS PATTERNS
       With lookups from indexed files such as DB or DBM, or from
       networked  tables  such as NIS, LDAP or SQL, the following
       lookup patterns are examined in the order as listed:

       domain.tld
              Matches domain.tld.
...

This does not say how the DNS resolution is done. My testing indicates 
that it's done in the same way as in $mynetworks, only acting on the 
hostname returned from the reverse DNS lookup.

Can postfix natively look up a record in forward DNS and apply access 
rules to the resulting IP address? If so I don't see how.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header