Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to relay mail from my laptop through my server. I've successfully configured postfix and SASL, and I can AUTH successfully using telnet.

dhcp-241:~ jgorset$ telnet 25
Connected to
Escape character is '^]'.
220 ESMTP Postfix
250-SIZE 10240000
250 DSN
AUTH PLAIN ***********************
235 2.7.0 Authentication successful
250 2.1.0 Ok
554 5.7.1 <>: Recipient address rejected: Access denied

As demonstrated above, I'm being denied relay through my postfix server even though I've authenticated and configured postfix to allow authenticated clients to relay mail.

# /etc/postfix/
# SMTP authentication
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
smtpd_recipient_restrictions = reject, permit_sasl_authenticated

Am I being rejected because the smtpd_recipient_restrictions option is set to reject, even though is specifically states to permit_sasl_authenticated? I was under the impression that the latter would override the former, seeing that you are required to enter either reject, defer, defer_if_permit or reject_unauth_destination with this option.

Update: Turns out this also happens if I telnet from localhost. If I comment out the smtpd_recipient_restrictions line, I can send mail to anyone (though only from localhost). I'd like to do so from any computer that authenticates using SASL. How should I go about this?


share|improve this question
up vote 3 down vote accepted

smtpd_receipient_restrictions are matched from left-to-right, first match wins.

You want smtpd_recipient_restrictions = permit_sasl_authenticated, reject

share|improve this answer
That did it. Thanks so much; I've been banging my head against the wall on this one for hours. – FRKT Mar 4 '10 at 10:38

smtp_recipient_restrictions are evaluated in order.

You probably want something that at least starts like this:

smtpd_recipient_restrictions = permit_sasl_authenticated permit_mynetworks

And then proceed to either reject all (if you are only sending mail and never receiving mail on this server) or reject things that look like spam - check out the postfix docs for UCE to get a good starting point.

share|improve this answer
This will create an open relay (no match at end of list = permit) – quadruplebucky Mar 4 '10 at 10:34
Sorry - meant to say "And then proceed to" -- perhaps the paragraph after the line wasn't clear. – Daniel Papasian Mar 4 '10 at 13:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.