how to reject ALL internet domain except whitelist using sendmail access file

[log]

I know howto reject individual TLD domain, it is well described billion times in sendmail docs,

From:bad    REJECT
From:good   OK

but is it possible reject all domains ? Now i use somethng ugly like

from:com                        REJECT
from:ru                 REJECT
from:it                 REJECT
from:ro                 REJECT
from:hu                 REJECT
...
from:net                REJECT
from:org                REJECT
from:fr                 REJECT
from:de                 REJECT
from:good_customer1@man.ok OK
from:good_customer2@man.ok OK
...

it is not work good because evently spam messages pass in using wired first level domain name.
I tryed

From:@ REJECT
From:. REJECT
From:*. REJECT

and lot of the same patterns but it is not work.

[fsck]

I don't think you can do what you are trying to do with stock sendmail, you might want to try postfix instead?
A more elegant solution might be to provide certificates to people who want to send you mail, and reject any non-certified senders using TLS/SSL. This is something you can do with sendmail.

[log]

sorry but it is very small office FreeBSD 4.7 IMAP server (cel266) that i only can tweak, not to change a lot (personally I prefere to replace it by FC4 but our ISP do not provide support if i do change). BTW, we use Orinoco wireles adaper to internet access and i gave up to make it work stable in FC4
So if it is not possible maybe is it good idea to copy all TLD from iana http://data.iana.org/TLD/tlds-alpha-by-domain.txt ? Does it guarantee full list of first level domains ?

[fsck]

It's probably close enough, and to stop spammers from using domains that don't exist or resolve, you could also look at commenting out "FEATURE(`accept_unresolvable_domains')" from sendmail.mc.
Also, consider denying connections to the mail service by TCP/IP. 2 ways to do this:

 172.16     DENY

would deny all mail from 172.x.x.x so logically

 1   DENY
 2 DENY
...
254 DENY

will deny mail from all IP addresses, then just make sure your good relays have OK records. Note that I have never tried this, so it might not work.
If you know the remote mailserver IP addresses you can also use the BSD packet filter to block all connections to port 25 except those from known good mailservers.

[log]

 1   DENY
 2 DENY
...
254 DENY

will deny mail from all IP addresses, then just make sure your good relays have OK records. Note that I have never tried this, so it might not work.

Thanks a lot, i will try it. Sure it make my boss happy ( he bored with endless spam that penetrate any filter and make this radical change to stop all except small number of selected customers to access office server)

[quirks1]

I know this thread is stone-age old, but I had the same problem and came up with a solution. It might be helpful for others, who come accross this post via Google like me. So mods, please don't crucify me.

As of 2012, sendmail still does not support white-listing (sigh). Access db is not suitable for this, because it is a black-list and trying to implement white-listing with a black-list is like trying to make a fence water-proof. If you cannot use the (in countless ways) superior postfix and are stuck with sendmail for whatever reason, then here is what you can do:

If you want to white-list based on sender addresses, put this at the end of your sendmail.mc:

LOCAL_CONFIG
Kwhitelist hash -T<TMPF> -aOK /etc/mail/whitelist
LOCAL_RULESETS
SLocal_check_mail
R$*     $: $(whitelist From:$1 $: ? $)
R?      $: $(whitelist Connect:$&{client_addr} $)
ROK     $@ OK
R$*     $#error $: 550 Access denied

If, on the other hand, you want to white-list based on recipient addresses, put this at the end of your sendmail.mc (it's practicaly the same code, the main difference being that the recipient instead of the sender is checked):

LOCAL_CONFIG
Kwhitelist hash -T<TMPF> -aOK /etc/mail/whitelist
LOCAL_RULESETS
SLocal_check_rcpt
R$*     $: $(whitelist To:$1 $: ? $)
R?      $: $(whitelist Connect:$&{client_addr} $)
ROK     $@ OK
R$*     $#error $: 550 Access denied

You can use both methods in conjuction, which would look like this:

LOCAL_CONFIG
Kwhitelist hash -T<TMPF> -aOK /etc/mail/whitelist
LOCAL_RULESETS
SLocal_check_mail
R$*     $: $(whitelist From:$1 $: ? $)
R?      $: $(whitelist Connect:$&{client_addr} $)
ROK     $@ OK
R$*     $#error $: 550 Access denied
SLocal_check_rcpt
R$*     $: $(whitelist To:$1 $: ? $)
R?      $: $(whitelist Connect:$&{client_addr} $)
ROK     $@ OK
R$*     $#error $: 550 Access denied

But please beware that then sender AND recipient addresses of a mail must have a match in the white-list. For example, if you white-listed sender@example.com and recipient@example.com, then the only accepted mails are those that have exactly this sender AND recipient. It does NOT mean that any mail from sender@example.com OR to recipient@example.com is accepted.

No matter, which method you choose, create a file /etc/mail/whitelist with the following content:

# This file contains a whitelist of e-mail and IP addresses.
# E-mail addresses listed here may send/receive mails to/from any host.
# Client IP addresses listed here are not affected by whitelisting, i.e.,
# they may send mail to/from any address.
# Any other requests will be REJECTed.
#
# Entries may have one of the following formats (the availability of
# "From" and "To" depends on whether sender or recipient checking is enabled):
#   From:<e-mail address of sender>
#   To:<e-mail address of recipient>
#   Connect:<IP address of client>
#
# It is NOT possible to specify wild-cards or to use full domains
# (e.g., "To:@example.com" in order to accept everything sent to an
# address ending on "@example.com").
# Make sure not to insert any whitespace.
#
# If you make any changes to this file, regenerate the database via
# makemap -e hash /etc/mail/whitelist.db < /etc/mail/whitelist
#
#
#
# white-listed senders
#
From:sender@example.com
#
# white-listed recipients
#
To:recipient@example.com
#
# do not restrict local connections
#
Connect:127.0.0.1
Connect:IPv6:::1
Connect:

Finally, build the white-list db and reload sendmail.

makemap -e hash /etc/mail/whitelist.db < /etc/mail/whitelist
/etc/init.d/sendmail reload

[glennzo]

How about if I just close the thread and leave it at that?