How do I allow clients to send mail from any address?

[moeffju]

I have a setup with multiple catchall domains for receiving mails and I want to allow clients to send mail from any address within their domains. An added complication is that I have a spamtrap subdomain set up. Let's say the domains are example.com and spam.example.com. I have one user with aliases for @example.com and @spam.example.com, so they can receive any mail sent to that domain. But when trying to send mail from a from address that has not been explicitly added, the server responds with

You are not allowed to send from this address.

I'm unsure how to fix this. I looked through the documentation at the different SMTP Inbound stages and Sieve Filters, but didn't find anything that looks obvious. Can someone give me pointers please?

I should add: Looking at the relevant code https://github.com/stalwartlabs/mail-server/blob/5885eaf3f8ce6e2cb330d3c9f3ab338e76968f8e/crates/smtp/src/inbound/mail.rs#L115 I don't see an obvious way to customize this either. Best I could do is disable the "auth_match_sender" option, but that feels like overshooting. And according to the documentation of that option, it seems that it should match anyway because the sending user is trying to send MAIL FROM test@spam.example.com and has the @spam.example.com alias. Am I missing something?

It appears to come down to https://github.com/stalwartlabs/mail-server/blob/5885eaf3f8ce6e2cb330d3c9f3ab338e76968f8e/crates/smtp/src/inbound/mail.rs#L112C20-L112C76 not matching catchall addresses, as they are not contained but need to be matched (!self.data.authenticated_emails.contains(&address_lcase)).

[mdecimus]

There is no need to disable must-match-sender completely, you could create an expression that selectively disables it for certain catch-all addresses (i.e. using a regex or checking for a value in a database).

[moeffju]

Thank you! So "hardcoding" the condition is straightforward enough. Do I have access to the list of email addresses associated to the authenticated user at this stage? I'm using the internal directory. Unfortunately I'm not familiar with Sieve and in the documentation I only found e.g. env.authenticated_as to get the user, and the query() function that appears to be limited to SQL lookup stores. Can I use that to query the internal directory, get the list of email addresses configured for the current authenticated user, and then match it myself?

[moeffju]

Also, is there some way to test Sieve scripts or expressions? I'd rather not experiment with this in "production", even if it's currently only running for a limited user base.

[mdecimus]

I've just pushed a commit that allows catch-all accounts to send e-mails from any address in the domain. This should fix the issue you're having I believe.

Also, is there some way to test Sieve scripts or expressions? I'd rather not experiment with this in "production", even if it's currently only running for a limited user base.

Not at the moment but there are plans to add a test environment to the webadmin.

[moeffju]

Thanks, that commit solves my problem exactly and I'm looking forward to the test environment :)

[mdecimus]

Great, a new version including this fix will be released at some point this week.