Restrict Sending to a Distribution List: 4 Easy Steps

By default every Zimbra user can send mail to every distribution list, including a list that reaches the whole company. To restrict sending to a distribution list you enable the Zimbra milter server and grant the sendToDistList right to the people who may use it. This article shows the four steps from the original post, then adds every grant pattern that the Zimbra Administrator Guide documents, plus how to undo a grant.

How this article was written: there is no Zimbra server in the author's lab, so nothing here is a fresh test run. The commands and the DENIED and ALLOWED results come from the original post, where an operator ran them on a real Zimbra 8.6 server. Every rule about defaults and syntax is taken from the Zimbra Administrator Guide.

How a distribution list restriction works

The guide states the default: "all users can send messages to all distribution lists." You change that by granting rights on a distribution list or on a domain. Once a list has a grant, a user without the right who sends to it gets a message saying they are not authorized to send messages to the recipient distribution list. The enforcement is done by the Zimbra Milter Server, which the guide lists among the MTA programs: it enforces which addresses can send to distribution lists and adds Reply-To and X-Zimbra-DL headers to messages sent from lists.

Step 1: create the distribution list and its members

If you do not have a list yet, create one and add members with zmprov (see the zmprov command guide for the syntax rules): cdl creates a list and adlm adds a member. Run them as the zimbra user:

$ zmprov cdl dltest@huuphan.local
$ zmprov adlm dltest@huuphan.local huupv1@huuphan.local
$ zmprov adlm dltest@huuphan.local huupv2@huuphan.local

Step 2: enable the milter server on the MTA

The guide says the milter server must be enabled, either globally under Home, Configure, Global Settings, MTA, Milter Server, or for one server under Configure, Servers, the server, MTA, Milter Server. It also warns: only enable a milter server on a server where an MTA is running. The original post enabled it from the command line for the local host and restarted the services:

$ zmprov ms `zmhostname` zimbraMilterServerEnabled TRUE
$ zmmailboxdctl restart
$ zmmtactl restart
$ zmcontrol status
$ zmmilterctl start

The last two commands check that every service is running and start the milter. The guide lists zmmilterctl as the tool that starts, stops and restarts the milter server "if enabled". Use the Admin Console if you prefer; the effect is the same.

Step 3: grant the right to send to the distribution list

Restrictions are made with zmprov grantRight (short name grr). To let only the members of the list send to it, the original post granted the right to the list itself as a group:

$ zmprov grr dl dltest@huuphan.local grp dltest@huuphan.local sendToDistList

This matches the guide's pattern "Access only to members of the distribution list": zmprov grr dl <list> grp <list2> sendToDistList, where the second list is the group whose members are allowed. Using the same list name twice means "its own members". The guide documents more grantee types for a single list, and each one has a matching rvr (revokeRight) command to remove the grant:

• usr <user@example.com> for one internal user.
• grp <list2@example.com> for the members of another list.
• dom <example.com> for all users in a domain.
• edom <example.com> for all users of an external domain.
• all for all internal users, and pub for all public email addresses.
• gst <someone@foo.com> "" for one specific external address.

To set a rule for every list at once, grant on the domain instead: zmprov grr domain <domain_name> usr <user1@example.com> sendToDistList for one user, or zmprov grr domain <domain_name> dom <example.com> sendToDistList for all users of a domain. The guide explains that when you grant the right on the domain, all distribution lists in the domain inherit the grant.

Step 4: check who is allowed to send

Test the result with the check command from the original post, which asks Zimbra whether an account has the right. The member huupv2 is allowed and shows through which grant (the "Via" block); the account huupv3 is not a member and is denied:

$ zmprov ckr dl dltest@huuphan.local huupv3@huuphan.local sendToDistList
DENIED
$ zmprov ckr dl dltest@huuphan.local huupv2@huuphan.local sendToDistList
ALLOWED
Via:
    target type  : dl
    target       : dltest@huuphan.local
    grantee type : grp
    grantee      : dltest@huuphan.local
    right        : sendToDistList

Also send a real test mail from a non-member and from a member. The non-member should get the "not authorized" message described in the guide, which proves that the milter is active and not only the grant.

Related: who can view the members of a distribution list

Sending and viewing are separate rights. The guide says the default is that all users can view the member addresses of a distribution list: the list shows a + in the address bubble, and a click expands it into the individual addresses. To restrict that, use the same grant command with the viewDistList right, for example zmprov grr domain <domain_name> usr <user1@example.com> viewDistList for one user, or zmprov grr domain <domain_name> dom <example.com> viewDistList for all users of a domain. Decide both rights together: a list that only members can send to may still expose its member addresses.

Common mistakes with a distribution list restriction

• Granting the right but never enabling the milter server, so the restriction is not enforced.
• Enabling the milter server on a host without an MTA, which the guide warns against.
• Forgetting that a grant on the domain is inherited by all lists in it.
• Skipping a real test mail, which is the only proof that the milter is active.

Mail that is refused by the milter is a different problem from mail refused by the MTA for a bad sender; for that, see how to reject a sender login mismatch.

FAQ

What happens if no rights are set? According to the guide, all users can send to all lists. Explicit grants are what restrict a list.

Can I allow an external domain? Yes, with the edom grantee type, or a single outside address with gst.

How do I undo a grant? Use zmprov rvr with the same arguments you used for grr.