In postfix, how to enforce tls + auth over 587 while leaving tls optional for 25

I would like to host mail services for some domains. I have succesfully setup postfix to consult sql for those virtual domains. What I would like to do is:

• For connections on 25:

  1. Deny relaying (only deliver to recipients of my virtual domains)
  2. Leave tls optional, but offer auth only if client does tls
  3. Accept only non-blacklisted clients (e.g restrict XBL+SBL+PBL from spamhaus) or clients that do tls and auth ("friend mail servers" that are setup to authenticate with me with auth and tls)

• For connections on 587:

  1. Enforce tls and auth
  2. Permit relaying.
  3. Accept only non-blacklisted clients (blacklists like above but leave out PBL checking)

My Questions:

• A. I know of the postfix options for the above , but I cant find how to differentiate them based on the listening port.

• B. Will I run into widely known problems with supposedly legit clients with the above policy?

I am new to mail server setup, sorry for any meaningless question/assupmtion (please point it). Thanks.

Solution 1:

That's easy,

1. In /etc/postfix/main.cf you will add/change

   smtpd_tls_security_level=may
   

   so that by default TLS is available (but optional).

2. Then, in your /etc/postfix/master.cf you will override it for port 587 (the submission port) by overriding the parameter:

   submission inet n       -       n       -       -       smtpd
     -o smtpd_tls_security_level=encrypt
   

   This requires TLS for all submission (port 587) connections.

As for denying relaying, this is the default; relaying is allowed only for authenticated users, and IP addresses you specify in mynetworks.

Finally you can add blacklists in main.cf by appending to smtpd_recipient_restrictions:

    reject_rbl_client zen.spamhaus.org,

or whatever blacklists you wish. These should appear near the end of the list, just before the final permit.

One last thing. For more ideas on how to prevent spam, see Fighting Spam - What can I do as an: Email Administrator, Domain Owner, or User?

Solution 2:

I don't know the answer to question B, but to A:

in postfix you usually have a master.cf where you define every single running process, often in /etc/postfix. In that file you have one entry per running postfix service, so there are two different ones for port 25 and port 587. For each of them you can also pass parameters to the smtpd to make them have different settings.

Thats an example from my mailserver:

4.3.2.1:25      inet  n       -       -       -       -       smtpd
  -o smtpd_sasl_auth_enable=yes
4.3.2.1:10027   inet  n       -       -       -       -       smtpd
  -o mynetworks=91.190.245.4/32 127.0.0.0/8
  -o smtpd_client_restrictions=permit_mynetworks,reject