starred/modoboa-modoboa

Fork 0

mirror of https://github.com/modoboa/modoboa.git synced 2026-04-25 17:06:01 +03:00

[GH-ISSUE #1073] Relaying - Recipient verification leaks destination mailbox host #897

New issue

Closed

opened 2026-02-27 11:14:09 +03:00 by kerem · 3 comments

kerem commented

2026-02-27 11:14:09 +03:00

Owner

Originally created by @Marcel92E on GitHub (Mar 10, 2017).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/1073

Impacted versions

Modoboa: 1.7.1
installer used: Yes
Webserver: Nginx

Steps to reproduce

Create "relay" domain and enable recipient verification
Send E-Mail to a non-existent user
Receive DSN-message

Current behavior

Rejecting message includes host/ip of destinations mailbox server

Expected behavior

Rejecting message just says that recipient could not be found

Video/Screenshot link (optional)

Hi,

im playing around with a test setup on a ubuntu 16.04.02 system. The installer worked fine, settings were made pretty fast but now i run into a problem. While relaying mails and verifying the existence of the destination user the error message when rejecting the mail (if the user doesnt exist) shows the ip/hostname of the final-destination server:

test@test.mydomain.com: host test-mx01.anotherdomain.com[123.123.123.123] said: 550
5.1.1 test@test.mydomain.com: Recipient address rejected: undeliverable
address: host mail.mydomain.com[111.111.111.111] said: 550 5.1.1
double-bounce@test-mx01.anotherdomain.com: Recipient address rejected: User unknown in virtual mailbox table (in reply to RCPT TO command) (in reply to RCPT TO command)

In my case i want to avoid telling the public which mx is responsible for the mailbox for that specific domain. Is there any possible way to mask the host/ip or just cut it off:

test@test.mydomain.com: host test-mx01.anotherdomain.com[123.123.123.123] said: 550
5.1.1 test@test.mydomain.com: Recipient address rejected

Is the creation of the full message hardcoded into postfix? If yes - any other way to avoid the leakage?

Thanks in advantage!

Originally created by @Marcel92E on GitHub (Mar 10, 2017). Original GitHub issue: https://github.com/modoboa/modoboa/issues/1073 # Impacted versions * Modoboa: 1.7.1 * installer used: Yes * Webserver: Nginx # Steps to reproduce 1. Create "relay" domain and enable recipient verification 2. Send E-Mail to a non-existent user 3. Receive DSN-message # Current behavior - Rejecting message includes host/ip of destinations mailbox server # Expected behavior - Rejecting message just says that recipient could not be found # Video/Screenshot link (optional) Hi, im playing around with a test setup on a ubuntu 16.04.02 system. The installer worked fine, settings were made pretty fast but now i run into a problem. While relaying mails and verifying the existence of the destination user the error message when rejecting the mail (if the user doesnt exist) shows the ip/hostname of the final-destination server: > <test@test.mydomain.com>: host test-mx01.anotherdomain.com[123.123.123.123] said: 550 5.1.1 <test@test.mydomain.com>: Recipient address rejected: undeliverable address: host mail.mydomain.com[111.111.111.111] said: 550 5.1.1 <double-bounce@test-mx01.anotherdomain.com>: Recipient address rejected: User unknown in virtual mailbox table (in reply to RCPT TO command) (in reply to RCPT TO command) In my case i want to avoid telling the public which mx is responsible for the mailbox for that specific domain. Is there any possible way to mask the host/ip or just cut it off: > <test@test.mydomain.com>: host test-mx01.anotherdomain.com[123.123.123.123] said: 550 5.1.1 <test@test.mydomain.com>: Recipient address rejected Is the creation of the full message hardcoded into postfix? If yes - any other way to avoid the leakage? Thanks in advantage!

kerem closed this issue

2026-02-27 11:14:09 +03:00

kerem commented

2026-02-27 11:14:10 +03:00

Author

Owner

@tonioo commented on GitHub (Mar 11, 2017):

@Exiver That's a good question and to be honest, I don't know the answer. Maybe you could ask on postfix mailing list?

@tonioo commented on GitHub (Mar 11, 2017): @Exiver That's a good question and to be honest, I don't know the answer. Maybe you could ask on postfix mailing list?

kerem commented

2026-02-27 11:14:10 +03:00

Author

Owner

@Marcel92E commented on GitHub (Mar 11, 2017):

@tonioo Thank you for your answer. I guess it was a little bit late yesterday when i ran into this problem. When i digged a little bit in postfix' documentation i found a solution (http://www.postfix.org/ADDRESS_VERIFICATION_README.html):

The parameter
unverified_recipient_reject_reason = Mailbox not available. Did you misspell the address?
can be used to set a custom message postfix will prompt to the sending smtp-server. You are even able to specify a custom defer code(not needed though):
unverified_recipient_defer_code = 450

and it will look like this:

test2@test.mydomain.com: host test-mx01.anotherdomain.com[123.123.123.123] said: 550
5.1.1 test2@test.mydomain.com: Recipient address rejected:
undeliverable address: Mailbox not available. Did you misspell the address?
(in reply to RCPT TO command)

I guess this one can be closed ;-)

@Marcel92E commented on GitHub (Mar 11, 2017): @tonioo Thank you for your answer. I guess it was a little bit late yesterday when i ran into this problem. When i digged a little bit in postfix' documentation i found a solution (http://www.postfix.org/ADDRESS_VERIFICATION_README.html): The parameter `unverified_recipient_reject_reason = Mailbox not available. Did you misspell the address?` can be used to set a custom message postfix will prompt to the sending smtp-server. You are even able to specify a custom defer code(not needed though): ` unverified_recipient_defer_code = 450` and it will look like this: > <test2@test.mydomain.com>: host test-mx01.anotherdomain.com[123.123.123.123] said: 550 5.1.1 <test2@test.mydomain.com>: Recipient address rejected: undeliverable address: Mailbox not available. Did you misspell the address? (in reply to RCPT TO command) I guess this one can be closed ;-)

kerem commented

2026-02-27 11:14:10 +03:00

Author

Owner

@tonioo commented on GitHub (Mar 11, 2017):

@Exiver Great :)

@tonioo commented on GitHub (Mar 11, 2017): @Exiver Great :)

kerem referenced this issue

2026-02-27 11:20:40 +03:00

[PR #897] [MERGED] add license title #2044