Subject: [ietf-smtp] FYI: Postfix rationale for delaying various policy checks to RCPT TO

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 16 Dec 2019 00:45:27 -0500

On Sun, Dec 15, 2019 at 11:12:21PM -0500, John C Klensin wrote:

[ On the ietf general list ]

> [...] and, while the specification arguably permits it, accepting the
> EHLO and then rejecting the mail transaction only after processing the
> MAIL and at least one RCPT command is probably at least in bad taste.

FWIW, that particular feature has some careful reasoning behind it:

    http://www.postfix.org/postconf.5.html#smtpd_delay_reject

    smtpd_delay_reject (default: yes)

        Wait until the RCPT TO command before evaluating
        $smtpd_client_restrictions, $smtpd_helo_restrictions and
        $smtpd_sender_restrictions, or wait until the ETRN command
        before evaluating $smtpd_client_restrictions and
        $smtpd_helo_restrictions.

        This feature is turned on by default because some clients
        apparently mis-behave when the Postfix SMTP server rejects
        commands before RCPT TO.

        The default setting has one major benefit: it allows Postfix to
        log recipient address information when rejecting a client
        name/address or sender address, so that it is possible to find
        out whose mail is being rejected.

When an SMTP server returns 5XX in either the greeting or in response to
EHLO, some clients treat that as a connection setup failure, not a
permanent message delivery failure, and move on to the next MX host, and
perhaps ultimately defer and retry the message:

    smtp_skip_5xx_greeting (default: yes)

        Skip remote SMTP servers that greet with a 5XX status code.

        By default, the Postfix SMTP client moves on the next mail
        exchanger. Specify "smtp_skip_5xx_greeting = no" if Postfix
        should bounce the mail immediately.

The reason for that was that at least at the time, various Microsoft
SMTP servers woul return 5XX greetings under transient high load.
Consequently, Postfix itself is one of the clients that treats
5XX as temporary failures in greetings (though not in EHLO).

Thus client-IP access control rules that would naïvely run at "CONNECT",
are by default deferred to RCPT TO, along with the rules that restrict
"EHLO" and "MAIL".

-- 
    Viktor.

---

From: Viktor Dukhovni <[email-masked]>
Date: Tue, 17 Dec 2019 15:07:20 -0500

When describing why Postfix defers most policy controls to "RCPT TO",
I wrote:

> On Dec 16, 2019, at 12:45 AM, Viktor Dukhovni <[email-masked]> wrote:
> 

Which brings me to the question of this new thread, what is the
meaning of a 554 greeting with respect to the sender's envelope?

* Is a 554 greeting semantically equivalent to TCP RST?  With the
  client moving on to the next MX host or deferring the message?

* Or, is the client expected to conclude that the recipient domain
  does not accept email and bounce all the envelope recipients?

The text is unclear.  Postfix assumes the former, and perhaps that's
actually the intent of the RFC?  Rereading this text recently, I am
not sure what it means.

-- 
	Viktor.