Unix and Linux → Re: Qmail or Postfix for small business domain, any experiences?

I'm an unregenerate sendmail user.

Given your two choices, the answer is easy. Go with postfix.

One of my objections to qmail, is that it accepts all mail, then later sends a bounce if the recipient does not exist. That's a problem in this day and age of forged sender addresses on spam and viruses. (There are probably patches to correct that misbehavior).

For me, the biggest issue is with the authors. The author of postfix has a professional attitude, and understands the importance of following public standards. The author of qmail thinks that the public standards are wrong, and insists on implementing what he thinks the standards should have been.

YES! This is my biggest concern with qmail as well. I used qmail until i got 3000 bounced messages to postmaster that was spam. sure theres a patch out there, but this is brain dead default behavior that should have been fixed in the official source tree. After that incident i went to postfix and its been smooth sailing.

It's not misbehaviour as the RFCs stipulate that bounces be sent. To get rid of bounce messages is a simple matter of configuration as I mentioned above:
That's all there is to it. You could also use multilog, or write something to syslog, or simply drop the message in the bit bucket.

As an aside, bouncing incorrectly addressed messages as originally intended can be quite useful, but our friends the spammers ruined it for all of us. It's similarly sad to see USENET being spammed into oblivion, or having to force grandma to get a clue on virus protection and OS updates. Sometimes I miss the days of 9600bps modem, when I was happily running sendmail configured as an open relay.

Take care,

Stefaan

Yes: me too. This was widely considered a public service - sad that it's no more.

Steve

I was referring to this part of the RFC (from section 3.3 of RFC2821):

  If the recipient is known not to be a deliverable address, the
  SMTP server returns a 550 reply, typically with a string such as
  "no such user - " and the mailbox name (other circumstances and
  reply codes are possible).

Sure, once the message has been accepted for a recipient, you must send a bounce if you cannot deliver. But the clear intention of the standard is that a bad recipient address should be rejected in an SMTP response code.Now that is a clear violation of the standard. The correct method is to reject invalid recipients at the RCPT command.Me too. Back in those good old days, they had not yet invented MIME. If we had stuck to plain text messages there would be no email viruses, no email phishing, and probably far less spam

Actually, returning information on the user name is also not a good practice in our spam-ridden email world. My approach makes no difference between correct and incorrect names, and so no information is leaking out.

It's all about what one's trying to achieve.

Take care,