Qmail Patch Explanations

These patches are far more powerful and flexible than most people give them credit for. For example, using such a patch, it is trivial to implement things like three-tuple greylisting (based on RECIPIENT, SENDER, and TCPREMOTEIP). You can also, as Soffian suggests, use a script that queries another server to see if the recipient is valid. I like this script in part because I can use different verification techniques depending on the domain (for example, I can do one kind of check for lists.memoryhole.net, and another for memoryhole.net itself). I often hear questions on the qmail mailing list that could be solved simply and easily with this (relatively trivial) patch, and every time, I am re-impressed with the power and flexibility that this patch provides. It doesn't get enough credit.
Since the original documentation of the RCPTCHECK patch seems to be offline, here's how it works: when the environment variable RCPTCHECK is set, qmail-smtpd will execute the program specified in that variable. Before the program is executed, the recipient in question is stored in the RECIPIENT environment variable, and the sender is stored in the SENDER environment variable. The exit code of the specified program determines whether qmail views the recipient as valid or not. Possible exit codes include:

100: Means that the recipient is invalid. The client receives a 553 error.
111: Means that there was a temporary problem verifying the recipient. The client recieves a 421 error code and the connection is closed.
120: Means that the recipient check program could not execute correctly. The client recieves a 421 error code and the connection is closed.
anything else: Means that the recipient is valid.

A trivial example script would be something like this:

#!/bin/sh
GoodRecipient=0
BadRecipient=100
Error=120
if grep "$RECIPIENT" /var/qmail/control/goodrcptto >/dev/null; then
	exit $GoodRecipient
else
	exit $BadRecipient
fi

Here's a slightly more complex example:

#!/bin/sh
GoodRecipient=0
BadRecipient=100
Error=120
User=$( echo "$RECIPIENT" | cut -d@ -f1 )
Domain=$( echo "$RECIPIENT" | cut -d@ -f2- )
if ! type id >/dev/null 2>&1 ; then
	# id program not in PATH
	exit $Error
fi
if id "$User" >/dev/null 2>&1 ; then
	exit $GoodRecipient
else
	exit $BadRecipient
fi

A basic example of how to do greylisting with this patch is here (based on Kelly French's script). Note that you'd want to combine that script with some other kind of recipient validation as well, and needs a cron job to clean up after itself.

Qmail Patch Explanations and Recommendations

Contents

Introduction

Minimum Patches

Small Site Patches

Patches for Big Sites