Skip to content

consider disabling sender verification

Users of the tails project are complaining that they cannot receive notifications from weblate server on their @torproject.org email address because of sender verification (reject_unverified_sender in Postfix). here's a part of a bounce they typically receive:

<XXXX@torproject.org>: host eugeni.torproject.org[49.12.57.136] said: 450
    4.1.7 <weblate@translate.tails.boum.org>: Sender address rejected:
    unverified address: host lizard.tails.boum.org[204.13.164.63] said: 554
    5.7.1 <weblate@translate.tails.boum.org>: Relay access denied (in reply to
    RCPT TO command) (in reply to RCPT TO command)
[ message/delivery-status ]
Reporting-MTA: dns; lizard.tails.boum.org
X-Postfix-Queue-ID: D121A4189A
X-Postfix-Sender: rfc822; weblate@translate.tails.boum.org
Arrival-Date: Thu, 17 Feb 2022 03:03:17 +0000 (UTC)

Final-Recipient: rfc822; XXXX@torproject.org
Original-Recipient: rfc822;XXXX@torproject.org
Action: delayed
Status: 4.1.7
Remote-MTA: dns; eugeni.torproject.org
Diagnostic-Code: smtp; 450 4.1.7 <weblate@translate.tails.boum.org>: Sender
    address rejected: unverified address: host
    lizard.tails.boum.org[204.13.164.63] said: 554 5.7.1
    <weblate@translate.tails.boum.org>: Relay access denied (in reply to RCPT
    TO command)
Will-Retry-Until: Tue, 22 Feb 2022 03:03:17 +0000 (UTC)
[ text/rfc822-headers ]
Return-Path: <weblate@translate.tails.boum.org>
Received: from 55e085888c8e (localhost [127.0.0.1])
        by lizard.tails.boum.org (Postfix) with ESMTP id D121A4189A
        for <XXXX@torproject.org>; Thu, 17 Feb 2022 03:03:17 +0000 (UTC)
Content-Type: multipart/related;
 boundary="===============8284330724149343160=="
MIME-Version: 1.0

we should consider disabling this check or allowing tail's weblate to bypass it.

if we do disable it system-wide, we should consider the impact it will have on incoming spam, as that probably stops a lot of abuse already... this might something we have stats on in prometheus.

Edited by anarcat
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information