Getting Apple’s Postfix to work with Microsoft’s SMTP service

This may come in handy for those of you who have to get MS SMTP to play nice with postfix.

Here is the scoop. A couple of our clients have a GFI Mail-Essentials anti-spam server (running on top of MS W2K4 Standard Server) in front of their Apple OS 10.3.x mail servers to filter out all that SPAM!

Once the anti-spam server filters the mail it uses the MS SMTP service built-into Microsoft Server 2004 Standard to forward that mail to Postfix on our OS X Server.

Problem 1) Postfix Config File.
Inside the postfix config file at /etc/postfix/main.cf there is a section entitled:

# REJECTING MAIL FOR UNKNOWN LOCAL USERS

If you scroll down a little you’ll see the following text:

# The default setting is 550 (reject mail) but it is safer to start
# with 450 (try again later) until you are certain that your
# local_recipient_maps settings are OK.
#
#unknown_local_recipient_reject_code = 550
unknown_local_recipient_reject_code = 450

Now even though it says the DEFAULT setting should be set to 550, for some reason Apple defaults to the “safer” 450 setting.

So here is what happens with the 450 setting.

The Microsoft server blindly checks all incoming mail, regardless of whether it’s valid, marks any SPAM e-mails as “SPAM” in the subject line and the blindly forwards all the mail onto the OS X server.

The OS X server then accepts the mail for the valid users. HOWEVER, because 450 is set in the postfix config file it tells the MS SMTP server to try and deliver the non-valid users again later. This causes a huge backlog of mail on your MS server and eventually the valid e-mails stop getting delivered. When you set that option to the supposed default setting of 550 the postfix service generates a NDR (non-delivery report) to the MS SMTP server and it stops trying to send that mail to a non-valid recipient. YEAH!

Problem 2) Open Relay
If you have the filters in Server Admin -> Mail -> Settings Button -> Filters Button set to allow SMTP relays from the IP address of the MS mail server you’ve got yourself an open relay. Make sure the MS SMTP server’s IP address is not in the accepted SMTP relay list. Because it blindly forwards e-mail to the postfix server you can relay mail by sending mail to the mail server with the TO: line formatted like so…

[username]%[username].[target domain]@[your domain here]

3) Postfix Aliases
Although this isn’t a problem… speaking of SPAM and open relays… it probably doesn’t hurt to edit the aliases file at /etc/aliases and set up some valid e-mail address in that file for abuse and postmaster. If you do get blacklisted those are the e-mail address that are going to get notification. Don’t forget to run the “newaliases” command after you’re done editing the file!

I’m sure I’m forgetting some stuff, so I’ll just leave off with… more on this topic later!