topic Re: Sendmail and DNS host checking in Operating System - HP-UX

Sendmail and DNS host checking

Ron Brown_2 — Thu, 12 Jan 2006 12:58:02 GMT

How can I disable DNS lookups when hosts attempt to connect to our mail gateway running HP-UX 11.00 and Sendmail version 8.11.1, config V9/Berkeley?

Re: Sendmail and DNS host checking

Geoff Wild — Thu, 12 Jan 2006 13:12:51 GMT

You can't really - other then shutdown the sendmail daemon.

You could limit it - so that DNS isn't configured at all on the server.

Rgds...Geoff

Re: Sendmail and DNS host checking

Ron Brown_2 — Thu, 12 Jan 2006 13:14:45 GMT

I believe, though, that disabling DNS would effectively stop all mail delivery. That would be bad.

Re: Sendmail and DNS host checking

Chan 007 — Thu, 12 Jan 2006 13:16:25 GMT

Ron,

Check this file

/etc/mail/service.switch

007

Re: Sendmail and DNS host checking

Geoff Wild — Thu, 12 Jan 2006 13:25:49 GMT

Not really - as you would go by what is in your /etc/hosts file.

See:

http://aplawrence.com/Bofcusm/22.html

Rgds...Geoff

Re: Sendmail and DNS host checking

Geoff Wild — Thu, 12 Jan 2006 13:27:31 GMT

Uh - cancel my last post - as I looked in the sendmail.cf file and saw this:

# service switch file (ignored on HP-UX, Solaris, Ultrix, OSF/1, others)
#O ServiceSwitchFile=/etc/mail/service.switch

Sorry about that...Geoff

Re: Sendmail and DNS host checking

Geoff Wild — Thu, 12 Jan 2006 13:34:18 GMT

Then again - you might want to test it - saw this in the FAQ:

http://www.sendmail.org/faq/section3.html#3.22

Rgds...Geoff

Re: Sendmail and DNS host checking

Ron Brown_2 — Thu, 12 Jan 2006 13:34:33 GMT

service.switch appears to merely switch lookups from DNS first to hosts first.

Any e-mail originating outside our network is currently looked up in DNS to check the validity of the sending domain; anything that does not resolve gets rejected. I am trying to avoid that. I want all mail to be accepted. Yes, I have additional security in place to help prevent bad stuff.

Re: Sendmail and DNS host checking

Christopher Caldwell — Thu, 12 Jan 2006 13:58:16 GMT

Domain lookups happen in two places:
1) connection of the RELAY - modern sendmail configurations want the RELAY to be defined in DNS
2) MAIL FROM: the domain portion of the users from address must generally look up in DNS.

You can bypass these features.

Get familiar with the README in
/usr/contrib/sendmail/usr/newconfig/etc/mail/cf

look at the accept_unresolvable_domains feature and the

You may need more. If you do, test commenting the
check_mail
check_rcpt
check_relay
rules in sendmail.cf. You won't need them all. If you're scared of M4/ you'll find gen_cf in a subdirectory of
/usr/contrib/sendmail/usr/newconfig/etc/mail//cf/cf
it uses menus.

These techniques bypass many of the anti-spam rules in sendmail.

If you've got more questions, ask 'em.

Re: Sendmail and DNS host checking

Ivan Ferreira — Thu, 12 Jan 2006 14:08:09 GMT

Yes, accept_unresolvable_domains is your option, you can try configuring sendmail using /usr/newconfig/etc/mail/cf/cf/gen_cf.

Use space as separator for the options.