Whitelist rule for reject_rbl_client in Postfix?

Question

Is there a way to add an exclusion/whitelist rule (or similar), which would work against reject_rbl_client behavior? I have a postfix service running, with following client restrictions:

smtpd_client_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_rbl_client zen.spamhaus.org,
    permit

Now I want my postfix to accept emails, sent from my home server. Home server sits on DSL connection, so the IP is always changing. Furthermore, whole IP pool from my ISP is blacklisted in spamhaus.org, so it gets normally rejected because of reject_rbl_client zen.spamhaus.org. Would it be possible somehow to configure postfix so, that it would add a rule, that emails, arriving from some specific Dynamic DNS host (which always resolves to my current home IP) would not be rejected?

Solution

Use check_client_access. Insert it before reject_rbl_client:

smtpd_client_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    check_client_access hash:/etc/postfix/rbl_override,
    reject_rbl_client zen.spamhaus.org,
    permit

Add in /etc/postfix/rbl_override

your.dynamic.dns OK

Don't forget to run postmap /etc/postfix/rbl_override

Detailed info: http://www.howtoforge.com/how-to-whitelist-hosts-ip-addresses-in-postfix

Comments

[Laimoncijus]

I guess the problem with dynamic DNS is that the IP itself resolves to some other domain, assigned by my ISP and not my.dynamic.dns I am trying to use - so emails get still rejected...

[Laurentiu Roescu]

If you server sends my.dynamic.dns as helo you could replace check_client_access with check_helo_access. This is a little bit dangerous because this can be forged. One other option could be SASL authentication in the postfix smtp client, I think this would be the best solution.

[Laimoncijus]

Thanks, I did end up with using SASL authentication after all - a little bit more setup on client side, but security is most important.