2026-07-01 08:14 UTC
Q - Who is still running #postfix sender address verification? https://www.postfix.org/ADDRESS_VERIFICATION_README.html / seems there are more and more "misconfigured" servers out there that I would need to whitelist to actually run proper sender's address verification. What's your take on this? Any useful feedback or tips? #SMTP
Replies (1)
-
@avian@toot.si 2026-07-01 08:43
@lowk3y@infosec.exchange This looks like what Exim calls a callout verification where you connect to sender's MX and see if it rejects RCPT. If so, then no. I'm not using it. Never did. Default config on Debian in fact has it so that you can only enable callouts for a list of sender domains not globally. I only have lighter weight sender verification enabled which more or less just does a DNS lookup and checks if the sender's domain has a valid MX.