[SMTP] Wrong user lookup about magma

[ba0f3]

hmm, it looks like magma pass all outgoing emails to smtp relay, and relay will send them back if they are internal mailboxes

magma --> relay --> external
    ^            |
    |____________|

if #61 get merged, magma will denied them w/ error 530 AUTHENTICATION REQUIRED

The question is why don't process them internally? and why magma let anyone (including relay) sends incoming as its users w/o authentication

sorry, but my English very bad

[ladar]

Any message that arrives on an authenticated SMTP connection gets relayed after passing the business rule checks. Including sending quotas, virus check, signs it using dkim, etc. If that user sent a message to a hosted domain it gets routed back on an unauthenticated connection and delivered. Trying to split that up, handoff some, but not others would be tricky.

As for accepting messages for hosted domains, on unauthenticated connections, they will get rejected if they fail the SPF check, which operates on the MAIL FROM. The SPF record should only allow messages from the relay servers to use hosted domains in the MAIL FROM.

What's trickier is validating the From: field inside the message body. That can be easily spoofed, and often is.

[ladar]

Oh! As for outbound messages, magma does check that the From: field inside the message body matches the user authentication credentials. Or at least it used to, so you can't spoof another user on the same server.

[ba0f3]

I think there is smth wrong w/ my user account, Dispatch data was not initialize yet.