Help configuring Sendmail for an ISP environment (inbound MX routers)

P.S. When I try to use my current setup, the following happens:

I send mail from client to test sendmail server for internal server.
my sendmail server is finding the MX records for the internal domain and using the address it finds to send the mail.
I thought MAIL_HUB would cause the mail to be sent to the server I specified?

I posted it in the first comment, OS is FreeBSD 4.9
Does virtusertable allow the format like:
user@domain     user@domain

My dumb internal server does not allow:
user@host.domain

I can generate the entire user listing, I was planning to do this to prevent mail to unknown users.

I've upgraded sendmail to 8.12.11 using the Ports package.

> Of course this means that the MX for all domains must point to the
> Sendmail relay server

This is already implemented, we are replacing an existing box with the new sendmail relay.  One serious problem with the existing box is it does not know who it's allowed to accept mail for, it thinks anything@mydomain is ok, that is one reason I'm moving over to using sendmail..

I've been reading about this for weeks now, I'm starting to think I should move towards using accessdb?

> Does virtusertable allow the format like:
> user@domain     user@domain

A qualified yes. Assuming that sendmail is configured to be the MX for domain1.tld and was configured to accept mail for said domain (the domain is listed in local-host-names) you could have a virtusertable record like:

addr@domain1.tld     real-addr@other-dom.tld

where other-dom.tld is not one of the domains that sendmail is relaying mail for. An attempt to relay mail to a domain on the sendmail server would be a loop.

What mail server do you have that won't accept mail addressed to user@machine.domain.tld? Even Exchange, as brain dead as it is w/respect to the RFC's, can do that with a bit of work. And if it reaslly can't be made to do that you've got a serious problem in trying to make this work. For sendmail to discriminate between valid users and other it must use either alias forwards or virtusertable records with explicit forwards to user@machine.domain.tld. Using relay-domains or mailertable ignores the user check because you've effectively told sendmail that it isn't going to have user information.

I'm using an old version of Vircom Vopmail 4.2.181, we have 3,000 e-mail accounts on it, and I'm worried that any changes on that box would lead to phone calls from our customers.

Would the access_db feature of sendmail work in this situation?

I'm thinking I would need to specify:
user1@domain.tld     Accept
user2@domain.tld     Accept
...
user3000@domain.tld     Accept
@domain.tld        Deny


I've seen this format someplace before..

Oh wow! Vpopmail... I'll bet it is running on NT, given the version.  I assume that you plan to move that to a FreeBSD or Linux system and that would be a pretty easy move. If you used Cyrus IMAP you could have true virtual user support in the mail system if desired.

My suspicion is that user checks are deferred until after "all relay" checks are done. But, I'm not sure and I haven't had time to look at a sendmail.cf to see if the access map is checked before relay-domains or mailtable are evaluated.

Not moving it yet but we want to get better filtering for it, I'm setting up Mimedefang + clamav + spamassassin.  I'm getting 3 servers for inbound mail relays for our customers.  We have issues with joe-jobs and other spam related troubles.  The problem is, our current (dumb) mail relay does not know which users are legit, it accepts for *@domain.tld without knowing if the user is valid on our internal mail server.  We want a sendmail box for a mail gateway that knows which users to accept for.  Save us a ton of bounced mail traffic.  Then the 3 mail relays will send the mail to our internal mail server.

My main question is how to accomplish setting up sendmail to know which users to accept mail for and then relay that mail to the internal server.

Not moving it yet but we want to get better filtering for it, I'm setting up Mimedefang + clamav + spamassassin.  I'm getting 3 servers for inbound mail relays for our customers.  We have issues with joe-jobs and other spam related troubles.  The problem is, our current (dumb) mail relay does not know which users are legit, it accepts for *@domain.tld without knowing if the user is valid on our internal mail server.  We want a sendmail box for a mail gateway that knows which users to accept for.  Save us a ton of bounced mail traffic.  Then the 3 mail relays will send the mail to our internal mail server.

My main question is how to accomplish setting up sendmail to know which users to accept mail for and then relay that mail to the internal server.

I question whether you need three fast boxes for the relay with only 3000 accounts if you use something more efficient than MimeDefang. My personal preference would be MailScanner (http://www.sng.ecs.soton.ac.uk/mailscanner/index.html) on RHEL 3.0 AS running on a pair of dual 2.xMhz Xeons. Unless you have an extreme mail volume you could easily handle the load with one box, but two provides a measure of redundancy. I've set up a two box solution for an ISP with 40K accounts on a pair of 2.0Mhz dual Pentium systems running RedHat 9 and had no problem handing in excess of 2GB of mail per box, per day and the Xenon's with RHEL 3.0 are going to outperform those by a good margin. I would defintely recommend that your relay servers be SCSI instead of IDE, if you want max performance. Mail filtering places a high disk I/O load on the system and the disconnect/reconnect and command tagged queueing of SCSI makes a difference.

As mentioned I'd use RHEL 3.0 over FreeBSD. The head to head comparisons that I've done show RHEL to be a clear winner in this application.

And when it is time to convert from Vpopmail I'd go with a Cyrus Aggreator (aka Murder) so that I'd have scalability and more resilence.

We see it like this, having 3 boxes for inbound mail will allow us to grow without needing to add new hardware for mail.  We also need 1 of those boxes for testing to ensure upgrades go smoothly, if we break one, we will still have enough power to keep on operating at normal speeds.  We will also have extra horsepower sitting around in case we need to utilize one of these servers for something else.

So it's looking like I can not get sendmail to do what I need to accomplish?  Without changing anything on my internal server?

I can program in VB so I am able to manipulate the data however it's needed for sendmail, I intend on everything being automatic, I just need to learn how to do it the first time ;)

I appreciate all the advice, but I am stuck to use what's been selected.  I just need help getting sendmail to accept for my users and relay mail to our internal server.

I'm stuck from all ends, our internal mail server uses an ODBC connection to get it's users, our billing system controls all aspects of e-mail account creation, delete, etc.  It doesn't provide an easy way to give everyone aliases to accept for user@host.domain.tld so I am forced to not re-write the mail.  If I manually add aliases to our mail server it will not be controlled by our billing system and I don't like manual work.

If you need just it inbound (jlevie, don't smile) for several domains why don't you put

MASQUERADE_DOMAIN(domain1.tlda)dnl
MASQUERADE_DOMAIN(domain2.tlda)dnl
MASQUERADE_DOMAIN(domain3.tlda)dnl
MASQUERADE_DOMAIN(domain4.tlda)dnl
...
MASQUERADE_DOMAIN(domain99.tlda)dnl

in your sendmail.mc? Put these domains in relay-domains as well. If you have more than one inbound MX box, just put the same configuration for each box.

jozatan,
I've got this working mostly, I've added my domains to relay-domains, specified blacklist_recp... and now I have my access db setup like:

To:user1@domain.tld     RELAY
To:user2@domain.tld     RELAY
...
To:user3k@domain.tld     RELAY
To:domain.tld     REJECT
To:.domain.tld     REJECT

This works as I am wanting, when a user is matched with RELAY they are allowed to receive mail, when it's not found, it rejects the message.  Is this going to give me adverse effects?

One problem I can't figure out is why sendmail is not using my specified mail_hub.  In my testing, I found that sendmail is doing a MX lookup for the domain and using that box to send the mail.  What feature do I need to force it to use a specified server?

It's an open relay in it's current form, I can't have that ;)

I tried using masquerade_domain but it didn't seem to have any impact?

I am checking out MailScanner now, it seems like it does all the other does and much easier, thanks for the recommendations.  Do you know if this program allows to block during the smtp session?  I have not have much time to read over the FAQ yet.
Thanks,

It does with dnsbl.

Just in case anyone finds this article looking for help, the learning curve needed to install Mimedefang is well worth the time required.  The ability to reject viruses & spam during the smtp session is well worth it.

MailScanner doesn't block during the SMTP session, which is an advantage and a disadvantage. The disadvantage is that a reject won't be in-line and as a part of the SMTP session. The adantage is one of reliability in that the message will have already been received and sitting in the input queue. So if something fails during scanning you don't loose the message. And it a trivial exercise to bypass scanning completely if the scanner isn't behaving properly by simply moving messages from the input queue to the delivery queue w/o any reconfigurations of anything.

While it has been about 5 months since I last compared MIMEdefang with MailScanner (I do that periodically since apps do change with time), MailScanner was still the hands down winner in terms of reliability and throughput.