basic restrictions

1 files changed, 22 insertions, 0 deletions

diff --git a/ymir.nix b/ymir.nix
index 8b2e1b12..80f1f11f 100644
--- a/ymir.nix
+++ b/ymir.nix
@@ -335,6 +335,28 @@ in rec {
       smtpd_sasl_security_options = noanonymous, noplaintext
       smtpd_sasl_tls_security_options = noanonymous
       smtpd_tls_auth_only = yes
+
+      smtpd_delay_reject = yes
+      smtpd_helo_required = yes
+      smtpd_helo_restrictions =
+        permit_mynetworks,
+        reject_non_fqdn_helo_hostname,
+        reject_invalid_helo_hostname,
+        permit
+
+      smtpd_sender_restrictions =
+        permit_mynetworks,
+        reject_non_fqdn_sender,
+        reject_unknown_sender_domain,
+        permit
+
+      smtpd_recipient_restrictions =
+        reject_unauth_pipelining,
+        reject_non_fqdn_recipient,
+        reject_unknown_recipient_domain,
+        permit_mynetworks,
+        reject_unauth_destination,
+        permit
     '';
     extraMasterConf = ''
       uucp unix - n n - - pipe flags=Fqhu user=uucp argv=/var/setuid-wrappers/uux -z -a$sender - $nexthop!rmail ($recipient)