Disable mailbox verification

[lukistellar]

Hi,

I would like to relay all mails which match the recipient domain configured in the internal stalwart directory to the next server. Is it possible to entirely disable the mailbox verification?

This would help me to prevent further increasing my attack surface by opening up ldap for the external relay. I would prefer to handle the verification only on my internal system. Both systems are running Stalwart.

My setup looks something like this:

[relay/external] <-- VPN --> [loadbalancer/dmz] <-- FW --> [mailserver/internal]

Thanks!

[mdecimus]

Hi,

Yes, check the RCPT section of the documentation, in particular the relay setting.

[lukistellar]

Hi,

thank you for your answer and sorry for the delay!

I already tried to configure the RCPT relay, but unfortunately I still get the same behavior:

2024-07-25T09:15:51.496418Z DEBUG session{instance="smtp" protocol=Smtp remote.ip="209.85.218.49" remote.port=43509}: smtp::inbound::rcpt: Mailbox does not exist. context="rcpt" event="error" address="test@<domain.tld>"

In this scenario, the mailbox exists on the mailserver/internal and not on the relay/external. For this test I have created an open relay by stating "true" on the last step:

I thought with the statement is_local_domain('', rcpt_domain) -> true I will enable the relay, but I probably just get it wrong.

Can you elaborate on the correct configuration?

Thank you!

[mdecimus]

I thought with the statement is_local_domain('', rcpt_domain) -> true I will enable the relay, but I probably just get it wrong.

There is no need to add this expression, the directory is first checked for local domains and addresses and if they can't be found then the "Allow Relaying" expressions are evaluated.

I'm confused by the screenshot you attached, all expressions are returning true. Also the second expression does not seem valid.

[lukistellar]

But still if I send a mail to "[email protected]", which exists on the internal mailserver, but not on the relay, I get the SMTP "550 Mailbox does not exist" directly from the relay, without it sending the mail to the next server.

The second expression should allow the relaying of outgoing mails from the internal mailserver, the value <loadbalancer-ip> reflects the ip-address of the loadbalancer which is used to communicate between the relay and the internal mailserver.
If I return "false" on this expression, I can't send any outgoing mails thru the relay. I have tested this right now, if I do so, the following error appears in he log of the relay:
smtp::inbound::session: event="write" data="550 5.1.2 Relay not allowed.\r\n" size=30

Also, am I wrong thinking that the SMTP is configured as an open relay if the last expression returns true? If so, doesn't that mean I shouldn't have this problem at all?

I want the relay to pass everything for the configured domains in the local directory to the next server. I have read the documentation and believe there is some kind of error in my logic, but I just don't get what I have to configure. What must I configure on the relay, to pass all mails from *@domail.tld to the next server?

Thank you!

[lukistellar]

I also have tested opening the relay up. If I delete the two lines I added in the relaying options, and state the last expression as true, I can basicly relay whatever I want.

Still I get the same behavior if I try to reach a mailbox which is only configured on the internal mailserver.
2024-07-27T13:40:56.194404Z DEBUG session{instance="smtp" protocol=Smtp remote.ip="209.85.218.47" remote.port=50608}: smtp::inbound::rcpt: Mailbox does not exist. context="rcpt" event="error" address="[email protected]"

Thank you!

[mdecimus]

You are seeing that error because it is a local domain and such mailbox does not exist. The relaying rule is used when a domain that is not local is provided.